Cyber Posture

CVE-2025-14231

Critical

Published: 16 January 2026

Published
16 January 2026
Modified
26 January 2026
KEV Added
Patch
CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0007 20.2th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-14231 is a critical-severity Out-of-bounds Write (CWE-787) vulnerability in Canon Mf455Dw Firmware. Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 20.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SC-7 (Boundary Protection) and SI-10 (Information Input Validation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.
Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

prevent

Flaw remediation directly addresses the buffer overflow by applying Canon firmware updates to patch the vulnerable WSD print job processing.

prevent

Boundary protection enforces network segmentation to prevent unauthenticated attackers on the same segment from sending malicious WSD print jobs.

prevent

Information input validation checks WSD print jobs for malformed data that could trigger the buffer overflow.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1210 Exploitation of Remote Services Lateral Movement
Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network.
Why these techniques?

Buffer overflow in exposed WSD print service enables remote unauthenticated exploitation for code execution or DoS, directly matching remote service and public-facing app exploitation techniques.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

Buffer overflow in print job processing by WSD on Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code. *: Satera LBP670C…

more

Series/Satera MF750C Series firmware v06.02 and earlier sold in Japan.Color imageCLASS LBP630C/Color imageCLASS MF650C Series/imageCLASS LBP230 Series/imageCLASS X LBP1238 II/imageCLASS MF450 Series/imageCLASS X MF1238 II/imageCLASS X MF1643i II/imageCLASS X MF1643iF II firmware v06.02 and earlier sold in US.i-SENSYS LBP630C Series/i-SENSYS MF650C Series/i-SENSYS LBP230 Series/1238P II/1238Pr II/i-SENSYS MF450 Series/i-SENSYS MF550 Series/1238i II/1238iF II/imageRUNNER 1643i II/imageRUNNER 1643iF II firmware v06.02 and earlier sold in Europe.

Deeper analysisAI

CVE-2025-14231 is a buffer overflow vulnerability (CWE-787) in the Web Services on Devices (WSD) print job processing component affecting various Canon Small Office Multifunction Printers and Laser Printers running firmware version v06.02 and earlier. Impacted models include the Satera LBP670C Series, Satera MF750C Series (Japan); Color imageCLASS LBP630C, Color imageCLASS MF650C Series, imageCLASS LBP230 Series, imageCLASS X LBP1238 II, imageCLASS MF450 Series, imageCLASS X MF1238 II, imageCLASS X MF1643i II, and imageCLASS X MF1643iF II (US); and i-SENSYS LBP630C Series, i-SENSYS MF650C Series, i-SENSYS LBP230 Series, 1238P II, 1238Pr II, i-SENSYS MF450 Series, i-SENSYS MF550 Series, 1238i II, 1238iF II, imageRUNNER 1643i II, and imageRUNNER 1643iF II (Europe). The vulnerability carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and was published on 2026-01-16.

An unauthenticated attacker on the same network segment can exploit this vulnerability remotely by sending malicious print jobs via WSD, potentially causing the affected printer to become unresponsive (denial of service) or enabling execution of arbitrary code with the privileges of the print processing service.

Canon advisories detail remediation measures, including firmware updates where available. Relevant guidance is provided in support notices at https://canon.jp/support/support-info/260115vulnerability-response, https://psirt.canon/advisory-information/cp2026-001/, https://www.canon-europe.com/support/product-security/, and https://www.usa.canon.com/support/canon-product-advisories/Service-Notice-Regarding-Remediation-Measure-Against-Potential-Buffer-Overflow-Vulnerability-in-Laser-Printers-and-Small-Office-Multifunctional-Printers. Security practitioners should verify affected devices, apply patches promptly, and segment printer networks to limit exposure.

Details

CWE(s)

Affected Products

canon
mf455dw firmware
≤ 06.02
canon
mf453dw firmware
≤ 06.02
canon
mf452dw firmware
≤ 06.02
canon
mf451dw firmware
≤ 06.02
canon
mf654cdw firmware
≤ 06.02
canon
mf656cdw firmware
≤ 06.02
canon
mf653cdw firmware
≤ 06.02
canon
mf652cw firmware
≤ 06.02
canon
mf1238 ii firmware
≤ 06.02
canon
mf1643if ii firmware
≤ 06.02
+6 more product configuration(s) — see NVD for full list

CVEs Like This One

CVE-2025-14232Same product: Canon Lbp1238 Ii
CVE-2025-14235Same product: Canon Lbp1238 Ii
CVE-2025-14234Same product: Canon Lbp1238 Ii
CVE-2025-14237Same product: Canon Lbp1238 Ii
CVE-2025-14236Same product: Canon Lbp1238 Ii
CVE-2025-14233Same product: Canon Lbp1238 Ii
CVE-2024-12647Same product: Canon Lbp1238 Ii
CVE-2024-12648Same product: Canon Lbp1238 Ii
CVE-2024-12649Same product: Canon Lbp1238 Ii
CVE-2026-5443Shared CWE-787

References