Cyber Posture

CVE-2025-14236

Critical

Published: 16 January 2026

Published
16 January 2026
Modified
26 January 2026
KEV Added
Patch
CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0007 20.2th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-14236 is a critical-severity Out-of-bounds Write (CWE-787) vulnerability in Canon Mf455Dw Firmware. Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation of Remote Services (T1210); ranked at the 20.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploitation of Remote Services (T1210) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.
Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

prevent

Directly remediates the buffer overflow vulnerability through timely application of Canon firmware updates v06.03 or later.

prevent

Mandates validation of Address Book attribute tag inputs to block crafted data causing the buffer overflow.

prevent

Enforces network boundary protections to restrict unauthenticated access to the vulnerable printer service from the local segment.

MITRE ATT&CK Enterprise TechniquesAI

T1210 Exploitation of Remote Services Lateral Movement
Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network.
T1499.004 Application or System Exploitation Impact
Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.
Why these techniques?

Buffer overflow enables remote unauthenticated RCE (T1210) and DoS via exploitation (T1499.004) on network-accessible printer services.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

Buffer overflow in Address Book attribute tag processing on Small Office Multifunction Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code. *: Satera LBP670C Series/Satera MF750C Series…

more

firmware v06.02 and earlier sold in Japan.Color imageCLASS LBP630C/Color imageCLASS MF650C Series/imageCLASS LBP230 Series/imageCLASS X LBP1238 II/imageCLASS MF450 Series/imageCLASS X MF1238 II/imageCLASS X MF1643i II/imageCLASS X MF1643iF II firmware v06.02 and earlier sold in US.i-SENSYS LBP630C Series/i-SENSYS MF650C Series/i-SENSYS LBP230 Series/1238P II/1238Pr II/i-SENSYS MF450 Series/i-SENSYS MF550 Series/1238i II/1238iF II/imageRUNNER 1643i II/imageRUNNER 1643iF II firmware v06.02 and earlier sold in Europe.

Deeper analysisAI

CVE-2025-14236 is a buffer overflow vulnerability (CWE-787) in the Address Book attribute tag processing component of various Canon Small Office Multifunction Printers and laser printers running firmware version v06.02 and earlier. Affected products sold in Japan include the Satera LBP670C Series and Satera MF750C Series. In the US, the vulnerability impacts the Color imageCLASS LBP630C Series, Color imageCLASS MF650C Series, imageCLASS LBP230 Series, imageCLASS X LBP1238 II, imageCLASS MF450 Series, imageCLASS X MF1238 II, imageCLASS X MF1643i II, and imageCLASS X MF1643iF II. European models affected are the i-SENSYS LBP630C Series, i-SENSYS MF650C Series, i-SENSYS LBP230 Series, 1238P II, 1238Pr II, i-SENSYS MF450 Series, i-SENSYS MF550 Series, 1238i II, 1238iF II, imageRUNNER 1643i II, and imageRUNNER 1643iF II.

The vulnerability has a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity with network accessibility, low attack complexity, no privileges or user interaction required, and high impacts across confidentiality, integrity, and availability. An unauthenticated attacker on the same network segment can send crafted data to trigger the buffer overflow, potentially causing the affected printer to become unresponsive (denial of service) or enabling execution of arbitrary code on the device.

Canon has published multiple advisories addressing this issue, including PSIRT advisory CP2026-001 and support notices for Japan, Europe, and the US. These detail remediation measures, such as firmware updates, against the buffer overflow in laser printers and small office multifunction printers. Security practitioners should review the vendor's product security pages for patch deployment instructions and verify firmware versions on deployed devices.

Details

CWE(s)

Affected Products

canon
mf455dw firmware
≤ 06.02
canon
mf453dw firmware
≤ 06.02
canon
mf452dw firmware
≤ 06.02
canon
mf451dw firmware
≤ 06.02
canon
mf654cdw firmware
≤ 06.02
canon
mf656cdw firmware
≤ 06.02
canon
mf653cdw firmware
≤ 06.02
canon
mf652cw firmware
≤ 06.02
canon
mf1238 ii firmware
≤ 06.02
canon
mf1643if ii firmware
≤ 06.02
+6 more product configuration(s) — see NVD for full list

CVEs Like This One

CVE-2025-14235Same product: Canon Lbp1238 Ii
CVE-2025-14232Same product: Canon Lbp1238 Ii
CVE-2025-14231Same product: Canon Lbp1238 Ii
CVE-2025-14234Same product: Canon Lbp1238 Ii
CVE-2025-14237Same product: Canon Lbp1238 Ii
CVE-2024-12647Same product: Canon Lbp1238 Ii
CVE-2024-12648Same product: Canon Lbp1238 Ii
CVE-2024-12649Same product: Canon Lbp1238 Ii
CVE-2025-14233Same product: Canon Lbp1238 Ii
CVE-2026-27815Shared CWE-787

References