Skip to content
major vulnerability· requires attention

RCE via network on widely deployed printer firmware; could disrupt operations.

Hardware

CVE-2025-14237

9.3
Critical
EPSS 0.99%Patch availableJan 16, 2026

Buffer overflow in XPS font parsing on printers enabling network remote code execution

common questions

Is CVE-2025-14237 being exploited?

Not confirmed. CVE-2025-14237 does not appear in CISA's Known Exploited Vulnerabilities catalog, which records only exploitation that has been observed and reported publicly. That is evidence of absence of a report, not evidence the flaw is unattacked. EPSS currently estimates a 0.99% probability of exploitation in the next 30 days.

How severe is CVE-2025-14237?

CVE-2025-14237 is rated Critical with a CVSS score of 9.3. Severity describes how bad exploitation would be, not how likely it is: pair it with exploitation evidence before deciding what to patch first.

Is there a patch for CVE-2025-14237?

Yes. A fix has been recorded for CVE-2025-14237. The vendor advisory is the authority on the exact fixed version — apply it from there rather than from a summary.

What does CVE-2025-14237 affect?

CVE-2025-14237 affects Satera LBP670C Series, Satera MF750C Series, Color imageCLASS LBP630C Series, Color imageCLASS MF650C Series, and 13 further products or versions. Confirm the exact affected versions against the vendor advisory before deciding you are exposed.

What should I do about CVE-2025-14237?

Update to latest vendor firmware

Exploitation status reflects CISA's KEV catalog as we last synced it. Check the catalog directly.

executive summary
technical analysis
affected
Satera LBP670C SeriesSatera MF750C SeriesColor imageCLASS LBP630C SeriesColor imageCLASS MF650C SeriesimageCLASS LBP230 SeriesimageCLASS X LBP1238 IIimageCLASS MF450 SeriesimageCLASS X MF1238 IIimageCLASS X MF1643i IIimageCLASS X MF1643iF IIimageRUNNER 1643i IIimageRUNNER 1643iF IIi-SENSYS LBP630C Seriesi-SENSYS MF650C Seriesi-SENSYS LBP230 Series1238P II/1238Pr II1238i II/1238iF II
impact

Remote code execution or crash via crafted XPS data over local network; attacker could take control of printer.

action required

Patch when possible

affected versions
Canon Inc. 1238iF II
  • affected06.02 and earlier
Canon Inc. 1238i II
  • affected06.02 and earlier
Canon Inc. 1238P II
  • affected06.02 and earlier
Canon Inc. 1238Pr II
  • affected06.02 and earlier
Canon Inc. Color imageCLASS LBP630C
  • affected06.02 and earlier
Canon Inc. Color imageCLASS MF650C Series
  • affected06.02 and earlier
Canon Inc. imageCLASS LBP230 Series
  • affected06.02 and earlier
Canon Inc. imageCLASS MF450 Series
  • affected06.02 and earlier
Canon Inc. imageCLASS X LBP1238 II
  • affected06.02 and earlier
Canon Inc. imageCLASS X MF1238 II
  • affected06.02 and earlier
Canon Inc. imageCLASS X MF1643iF II
  • affected06.02 and earlier
Canon Inc. imageCLASS X MF1643i II
  • affected06.02 and earlier
Canon Inc. imageRUNNER 1643iF II
  • affected06.02 and earlier
Canon Inc. imageRUNNER 1643i II
  • affected06.02 and earlier
Canon Inc. i-SENSYS LBP230 Series
  • affected06.02 and earlier
Canon Inc. i-SENSYS LBP630C Series
  • affected06.02 and earlier
Canon Inc. i-SENSYS MF450 Series
  • affected06.02 and earlier
Canon Inc. i-SENSYS MF550 Series
  • affected06.02 and earlier
Canon Inc. i-SENSYS MF650C Series
  • affected06.02 and earlier
Canon Inc. Satera LBP670C Series
  • affected06.02 and earlier
Canon Inc. Satera MF750C Series
  • affected06.02 and earlier

As published in the CVE Program record. A version outside these ranges is not a statement that it is unaffected — vendors sometimes understate a range, and distribution-backported builds carry upstream numbers that do not reflect what was patched into them.

how to fix
Remediation steps are tailored for users whose stack is affected. Add this technology to your stack to see the fix checklist.
references
get alerted

Track only the vulnerabilities that affect your infrastructure.

start for free