PT-2026-3190 · Canon · 1238I Ii+20

Published 2026-01-15 · Updated 2026-03-16 · CVE-2025-14235

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Canon Satera LBP670C Series/Satera MF750C Series firmware versions v06.02 and earlier Canon Color imageCLASS LBP630C/Color imageCLASS MF650C Series/imageCLASS LBP230 Series/imageCLASS X LBP1238 II/imageCLASS MF450 Series/imageCLASS X MF1238 II/imageCLASS X MF1643i II/imageCLASS X MF1643iF II firmware versions v06.02 and earlier Canon i-SENSYS LBP630C Series/i-SENSYS MF650C Series/i-SENSYS LBP230 Series/1238P II/1238Pr II/i-SENSYS MF450 Series/i-SENSYS MF550 Series/1238i II/1238iF II/imageRUNNER 1643i II/imageRUNNER 1643iF II firmware versions v06.02 and earlier

Description A buffer overflow exists in the XPS font fpgm data processing component of Small Office Multifunction Printers and Laser Printers. This issue may allow an attacker on the network segment to cause the affected product to become unresponsive or to execute arbitrary code.

Recommendations Update Canon Satera LBP670C Series/Satera MF750C Series firmware to a version later than v06.02. Update Canon Color imageCLASS LBP630C/Color imageCLASS MF650C Series/imageCLASS LBP230 Series/imageCLASS X LBP1238 II/imageCLASS MF450 Series/imageCLASS X MF1238 II/imageCLASS X MF1643i II/imageCLASS X MF1643iF II firmware to a version later than v06.02. Update Canon i-SENSYS LBP630C Series/i-SENSYS MF650C Series/i-SENSYS LBP230 Series/1238P II/1238Pr II/i-SENSYS MF450 Series/i-SENSYS MF550 Series/1238i II/1238iF II/imageRUNNER 1643i II/imageRUNNER 1643iF II firmware to a version later than v06.02.

Fix

RCE

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2025-14235

ZDI-26-206

Affected Products

1238P Ii

1238Pr Ii

1238I Ii

1238If Ii

Color Imageclass Lbp630C

Color Imageclass Mf650C Series

Satera Lbp670C Series

Satera Mf750C Series

I-Sensys Lbp230 Series

I-Sensys Lbp630C Series

I-Sensys Mf450 Series

I-Sensys Mf550 Series

I-Sensys Mf650C Series

Imageclass Lbp230 Series

Imageclass Mf450 Series

Imageclass X Lbp1238 Ii

Imageclass X Mf1238 Ii

Imageclass X Mf1643I Ii

Imageclass X Mf1643If Ii

Imagerunner 1643I Ii

Imagerunner 1643If Ii

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2025-14235 · Security Note
• https://usa.canon.com/support/canon-product-advisories/Service-Notice-Regarding-Remediation-Measure-Against-Potential-Buffer-Overflow-Vulnerability-in-Laser-Printers-and-Small-Office-Multifunctional-Printers · Vendor Advisory
• https://canon.jp/support/support-info/260115vulnerability-response · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-14235 · Vendor Advisory
• https://psirt.canon/advisory-information/cp2026-001 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-26-206 · Security Note
• https://canon-europe.com/support/product-security · Vendor Advisory
• https://twitter.com/CVEnew/status/2012126472568254568 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2012066397568766316 · Twitter Post