Skip to content
major vulnerability· requires attention

Widely deployed office printer firmware across multiple vendors; critical impact could disrupt printing and workflow.

Hardware

CVE-2025-14235

9.3
Critical
EPSS 0.92%Patch availableJan 16, 2026

Network buffer overflow in printer firmware font handling enables code execution.

common questions

Is CVE-2025-14235 being exploited?

Not confirmed. CVE-2025-14235 does not appear in CISA's Known Exploited Vulnerabilities catalog, which records only exploitation that has been observed and reported publicly. That is evidence of absence of a report, not evidence the flaw is unattacked. EPSS currently estimates a 0.92% probability of exploitation in the next 30 days.

How severe is CVE-2025-14235?

CVE-2025-14235 is rated Critical with a CVSS score of 9.3. Severity describes how bad exploitation would be, not how likely it is: pair it with exploitation evidence before deciding what to patch first.

Is there a patch for CVE-2025-14235?

Yes. A fix has been recorded for CVE-2025-14235. The vendor advisory is the authority on the exact fixed version — apply it from there rather than from a summary.

What does CVE-2025-14235 affect?

CVE-2025-14235 affects Satera LBP670C Series, Satera MF750C Series, Color imageCLASS LBP630C, Color imageCLASS MF650C Series, and 17 further products or versions. Confirm the exact affected versions against the vendor advisory before deciding you are exposed.

What should I do about CVE-2025-14235?

Update firmware to latest vendor release

Exploitation status reflects CISA's KEV catalog as we last synced it. Check the catalog directly.

executive summary
technical analysis
affected
Satera LBP670C SeriesSatera MF750C SeriesColor imageCLASS LBP630CColor imageCLASS MF650C SeriesimageCLASS LBP230 SeriesimageCLASS X LBP1238 IIimageCLASS MF450 SeriesimageCLASS X MF1238 IIimageCLASS X MF1643i IIimageCLASS X MF1643iF IIimageRUNNER 1643i IIimageRUNNER 1643iF IIi-SENSYS LBP630C Seriesi-SENSYS MF650C Seriesi-SENSYS LBP230 Series1238P II1238Pr IIi-SENSYS MF450 Seriesi-SENSYS MF550 Series1238i II1238iF II
impact

Remote attacker on local network can crash device or execute arbitrary code via crafted XPS font data.

action required

Patch when possible

affected versions
Canon Inc. 1238iF II
  • affected06.02 and earlier
Canon Inc. 1238i II
  • affected06.02 and earlier
Canon Inc. 1238P II
  • affected06.02 and earlier
Canon Inc. 1238Pr II
  • affected06.02 and earlier
Canon Inc. Color imageCLASS LBP630C
  • affected06.02 and earlier
Canon Inc. Color imageCLASS MF650C Series
  • affected06.02 and earlier
Canon Inc. imageCLASS LBP230 Series
  • affected06.02 and earlier
Canon Inc. imageCLASS MF450 Series
  • affected06.02 and earlier
Canon Inc. imageCLASS X LBP1238 II
  • affected06.02 and earlier
Canon Inc. imageCLASS X MF1238 II
  • affected06.02 and earlier
Canon Inc. imageCLASS X MF1643iF II
  • affected06.02 and earlier
Canon Inc. imageCLASS X MF1643i II
  • affected06.02 and earlier
Canon Inc. imageRUNNER 1643iF II
  • affected06.02 and earlier
Canon Inc. imageRUNNER 1643i II
  • affected06.02 and earlier
Canon Inc. i-SENSYS LBP230 Series
  • affected06.02 and earlier
Canon Inc. i-SENSYS LBP630C Series
  • affected06.02 and earlier
Canon Inc. i-SENSYS MF450 Series
  • affected06.02 and earlier
Canon Inc. i-SENSYS MF550 Series
  • affected06.02 and earlier
Canon Inc. i-SENSYS MF650C Series
  • affected06.02 and earlier
Canon Inc. Satera LBP670C Series
  • affected06.02 and earlier
Canon Inc. Satera MF750C Series
  • affected06.02 and earlier

As published in the CVE Program record. A version outside these ranges is not a statement that it is unaffected — vendors sometimes understate a range, and distribution-backported builds carry upstream numbers that do not reflect what was patched into them.

how to fix
Remediation steps are tailored for users whose stack is affected. Add this technology to your stack to see the fix checklist.
references
get alerted

Track only the vulnerabilities that affect your infrastructure.

start for free