PT-2026-3191 · Canon · 1238I Ii+20

Published 2026-01-15 · Updated 2026-03-16 · CVE-2025-14236

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Satera LBP670C Series/Satera MF750C Series versions v06.02 and earlier Color imageCLASS LBP630C/Color imageCLASS MF650C Series/imageCLASS LBP230 Series/imageCLASS X LBP1238 II/imageCLASS MF450 Series/imageCLASS X MF1238 II/imageCLASS X MF1643i II/imageCLASS X MF1643iF II versions v06.02 and earlier i-SENSYS LBP630C Series/i-SENSYS MF650C Series/i-SENSYS LBP230 Series/1238P II/1238Pr II/i-SENSYS MF450 Series/i-SENSYS MF550 Series/1238i II/1238iF II/imageRUNNER 1643i II/imageRUNNER 1643iF II versions v06.02 and earlier

Description A buffer overflow exists in the Address Book attribute tag processing of Small Office Multifunction Printers. This issue could allow an attacker on the same network segment to cause the device to become unresponsive or to execute arbitrary code.

Recommendations Update Satera LBP670C Series/Satera MF750C Series firmware to a version later than v06.02. Update Color imageCLASS LBP630C/Color imageCLASS MF650C Series/imageCLASS LBP230 Series/imageCLASS X LBP1238 II/imageCLASS MF450 Series/imageCLASS X MF1238 II/imageCLASS X MF1643i II/imageCLASS X MF1643iF II firmware to a version later than v06.02. Update i-SENSYS LBP630C Series/i-SENSYS MF650C Series/i-SENSYS LBP230 Series/1238P II/1238Pr II/i-SENSYS MF450 Series/i-SENSYS MF550 Series/1238i II/1238iF II/imageRUNNER 1643i II/imageRUNNER 1643iF II firmware to a version later than v06.02.

Fix

RCE

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2025-14236

ZDI-26-207

Affected Products

1238P Ii

1238Pr Ii

1238I Ii

1238If Ii

Color Imageclass Lbp630C

Color Imageclass Mf650C Series

Satera Lbp670C Series

Satera Mf750C Series

I-Sensys Lbp230 Series

I-Sensys Lbp630C Series

I-Sensys Mf450 Series

I-Sensys Mf550 Series

I-Sensys Mf650C Series

Imageclass Lbp230 Series

Imageclass Mf450 Series

Imageclass X Lbp1238 Ii

Imageclass X Mf1238 Ii

Imageclass X Mf1643I Ii

Imageclass X Mf1643If Ii

Imagerunner 1643I Ii

Imagerunner 1643If Ii

References · 10

• https://zerodayinitiative.com/advisories/ZDI-26-207 · Security Note
• https://usa.canon.com/support/canon-product-advisories/Service-Notice-Regarding-Remediation-Measure-Against-Potential-Buffer-Overflow-Vulnerability-in-Laser-Printers-and-Small-Office-Multifunctional-Printers · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-14236 · Vendor Advisory
• https://canon.jp/support/support-info/260115vulnerability-response · Vendor Advisory
• https://psirt.canon/advisory-information/cp2026-001 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-14236 · Security Note
• https://canon-europe.com/support/product-security · Vendor Advisory
• https://twitter.com/CVEnew/status/2012126471632957625 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2012063838095487215 · Twitter Post
• https://twitter.com/TheHackerWire/status/2011966575302025540 · Twitter Post