ByteOS Network

Type	CWE ID	Description
CWE	CWE-787	CWE-787: Out-of-bounds Write

Version	Base score	Base severity	Vector
4.0	9.3	CRITICAL	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
3.1	9.8	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Hyperlink	Resource
https://psirt.canon/advisory-information/cp2026-001/	vendor-advisory
https://canon.jp/support/support-info/260115vulnerability-response	vendor-advisory
https://www.usa.canon.com/support/canon-product-advisories/Service-Notice-Regarding-Remediation-Measure-Against-Potential-Buffer-Overflow-Vulnerability-in-Laser-Printers-and-Small-Office-Multifunctional-Printers	vendor-advisory
https://www.canon-europe.com/support/product-security/	vendor-advisory

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Type	Version	Base score	Base severity	Vector
Secondary	4.0	9.3	CRITICAL	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Secondary	3.1	9.8	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE ID	Type	Source
CWE-787	Secondary	f98c90f0-e9bd-4fa7-911b-51993f3571fd

Hyperlink	Source	Resource
https://canon.jp/support/support-info/260115vulnerability-response	f98c90f0-e9bd-4fa7-911b-51993f3571fd	Vendor Advisory
https://psirt.canon/advisory-information/cp2026-001/	f98c90f0-e9bd-4fa7-911b-51993f3571fd	Vendor Advisory
https://www.canon-europe.com/support/product-security/	f98c90f0-e9bd-4fa7-911b-51993f3571fd	Vendor Advisory
https://www.usa.canon.com/support/canon-product-advisories/Service-Notice-Regarding-Remediation-Measure-Against-Potential-Buffer-Overflow-Vulnerability-in-Laser-Printers-and-Small-Office-Multifunctional-Printers	f98c90f0-e9bd-4fa7-911b-51993f3571fd	Vendor Advisory

CVE-2023-0852

Matching Score-10

Assigner-Canon Inc.

View Details

Matching Score-10

Assigner-Canon Inc.

CVSS Score-9.8||CRITICAL

EPSS-0.30% / 53.65%

||

7 Day CHG-0.07%

Published-11 May, 2023 | 00:00

Updated-10 Feb, 2025 | 21:00

Buffer overflow in the Address Book of Mobile Device function of Office / Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code. *:Satera LBP660C Series/LBP620C Series/MF740C Series/MF640C Series firmware Ver.11.04 and earlier sold in Japan. Color imageCLASS LBP660C Series/LBP 620C Series/X LBP1127C/MF740C Series/MF640C Series/X MF1127C firmware Ver.11.04 and earlier sold in US. i-SENSYS LBP660C Series/LBP620C Series/MF740C Series/MF640C Series, C1127P, C1127iF, C1127i firmware Ver.11.04 and earlier sold in Europe.

Vendor-Canon Inc.

Product-i-sensys_x_c1127i i-sensys_mf645cx_firmware mf741cdw_firmware i-sensys_x_c1127p mf745cdw imageprograf_tc-20m i-sensys_mf746cx_firmware mf273dw_firmware i-sensys_mf641cw_firmware mf641cw imageprograf_tc-20m_firmware mf1127c_firmware i-sensys_mf641cw i-sensys_lbp623cdw lbp1127c mf275dw lbp621c_firmware maxify_gx4020 lbp122dw mf262dw_ii lbp622cdw_firmware i-sensys_lbp623cdw_firmware mf743cdw lbp661c_firmware maxify_gx3020 mf746cdw mf644cdw_firmware mf267dw_ii_firmware lbp1127c_firmware mf1127c lbp622c_firmware mf269dw_ii mf745cdw_firmware i-sensys_mf746cx imageprograf_tc-20_firmware i-sensys_mf744cdw mf269dw_vp_ii_firmware lbp662c_firmware mf642cdw_firmware mf746cdw_firmware i-sensys_x_c1127p_firmware mf273dw i-sensys_x_c1127i_firmware imageprograf_tc-20 i-sensys_lbp621cw i-sensys_x_c1127if i-sensys_x_c1127if_firmware mf272dw_firmware mf644cdw i-sensys_lbp664cx lbp664cdw_firmware pixma_g4270 pixma_g3270 i-sensys_mf645cx i-sensys_lbp633cdw_firmware i-sensys_mf744cdw_firmware lbp623cdw_firmware pixma_g4270_firmware lbp622c pixma_g3270_firmware i-sensys_mf643cdw_firmware maxify_gx4020_firmware i-sensys_lbp621cw_firmware mf272dw mf641cw_firmware lbp622cdw lbp664c_firmware i-sensys_lbp633cdw mf264dw_ii mf642cdw mf264dw_ii_firmware lbp662c lbp621c i-sensys_mf742cdw_firmware mf262dw_ii_firmware lbp122dw_firmware lbp661c i-sensys_mf742cdw mf743cdw_firmware lbp664cdw mf269dw_ii_firmware i-sensys_mf643cdw mf269dw_vp_ii i-sensys_lbp664cx_firmware mf275dw_firmware lbp664c mf267dw_ii maxify_gx3020_firmware mf741cdw lbp623cdw Canon Office/Small Office Multifunction Printers and Laser Printers

CWE ID-CWE-121

Stack-based Buffer Overflow

CWE ID-CWE-787

Out-of-bounds Write

CVE-2023-0851

Matching Score-10

Assigner-Canon Inc.

View Details

Matching Score-10

Assigner-Canon Inc.

CVSS Score-9.8||CRITICAL

EPSS-0.30% / 53.65%

||

7 Day CHG-0.07%

Published-11 May, 2023 | 00:00

Updated-10 Feb, 2025 | 20:58

Buffer overflow in CPCA Resource Download process of Office / Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code. *:Satera LBP660C Series/LBP620C Series/MF740C Series/MF640C Series firmware Ver.11.04 and earlier sold in Japan. Color imageCLASS LBP660C Series/LBP 620C Series/X LBP1127C/MF740C Series/MF640C Series/X MF1127C firmware Ver.11.04 and earlier sold in US. i-SENSYS LBP660C Series/LBP620C Series/MF740C Series/MF640C Series, C1127P, C1127iF, C1127i firmware Ver.11.04 and earlier sold in Europe.

Vendor-Canon Inc.

Product-i-sensys_x_c1127i i-sensys_mf645cx_firmware mf741cdw_firmware i-sensys_x_c1127p mf745cdw imageprograf_tc-20m i-sensys_mf746cx_firmware mf273dw_firmware i-sensys_mf641cw_firmware mf641cw imageprograf_tc-20m_firmware mf1127c_firmware i-sensys_mf641cw i-sensys_lbp623cdw lbp1127c mf275dw lbp621c_firmware maxify_gx4020 lbp122dw mf262dw_ii lbp622cdw_firmware i-sensys_lbp623cdw_firmware mf743cdw lbp661c_firmware maxify_gx3020 mf746cdw mf644cdw_firmware mf267dw_ii_firmware lbp1127c_firmware mf1127c lbp622c_firmware mf269dw_ii mf745cdw_firmware i-sensys_mf746cx imageprograf_tc-20_firmware i-sensys_mf744cdw mf269dw_vp_ii_firmware lbp662c_firmware mf642cdw_firmware mf746cdw_firmware i-sensys_x_c1127p_firmware mf273dw i-sensys_x_c1127i_firmware imageprograf_tc-20 i-sensys_lbp621cw i-sensys_x_c1127if i-sensys_x_c1127if_firmware mf272dw_firmware mf644cdw i-sensys_lbp664cx lbp664cdw_firmware pixma_g4270 pixma_g3270 i-sensys_mf645cx i-sensys_lbp633cdw_firmware i-sensys_mf744cdw_firmware lbp623cdw_firmware pixma_g4270_firmware lbp622c pixma_g3270_firmware i-sensys_mf643cdw_firmware maxify_gx4020_firmware i-sensys_lbp621cw_firmware mf272dw mf641cw_firmware lbp622cdw lbp664c_firmware i-sensys_lbp633cdw mf264dw_ii mf642cdw mf264dw_ii_firmware lbp662c lbp621c i-sensys_mf742cdw_firmware mf262dw_ii_firmware lbp122dw_firmware lbp661c i-sensys_mf742cdw mf743cdw_firmware lbp664cdw mf269dw_ii_firmware i-sensys_mf643cdw mf269dw_vp_ii i-sensys_lbp664cx_firmware mf275dw_firmware lbp664c mf267dw_ii maxify_gx3020_firmware mf741cdw lbp623cdw Canon Office/Small Office Multifunction Printers and Laser Printers

CWE ID-CWE-122

Heap-based Buffer Overflow

CWE ID-CWE-787

Out-of-bounds Write

CVE-2023-0856

Matching Score-10

Assigner-Canon Inc.

View Details

Matching Score-10

Assigner-Canon Inc.

CVSS Score-9.8||CRITICAL

EPSS-0.28% / 51.29%

||

7 Day CHG-0.07%

Published-11 May, 2023 | 00:00

Updated-10 Feb, 2025 | 21:00

Buffer overflow in IPP sides attribute process of Office / Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code. *:Satera LBP660C Series/LBP620C Series/MF740C Series/MF640C Series firmware Ver.11.04 and earlier sold in Japan. Color imageCLASS LBP660C Series/LBP 620C Series/X LBP1127C/MF740C Series/MF640C Series/X MF1127C firmware Ver.11.04 and earlier sold in US. i-SENSYS LBP660C Series/LBP620C Series/MF740C Series/MF640C Series, C1127P, C1127iF, C1127i firmware Ver.11.04 and earlier sold in Europe.

Vendor-Canon Inc.

Product-i-sensys_x_c1127i i-sensys_mf645cx_firmware mf741cdw_firmware i-sensys_x_c1127p mf745cdw imageprograf_tc-20m i-sensys_mf746cx_firmware mf273dw_firmware i-sensys_mf641cw_firmware mf641cw imageprograf_tc-20m_firmware mf1127c_firmware i-sensys_mf641cw i-sensys_lbp623cdw lbp1127c mf275dw lbp621c_firmware maxify_gx4020 lbp122dw mf262dw_ii lbp622cdw_firmware i-sensys_lbp623cdw_firmware mf743cdw lbp661c_firmware maxify_gx3020 mf746cdw mf644cdw_firmware mf267dw_ii_firmware lbp1127c_firmware mf1127c lbp622c_firmware mf269dw_ii mf745cdw_firmware i-sensys_mf746cx imageprograf_tc-20_firmware i-sensys_mf744cdw mf269dw_vp_ii_firmware lbp662c_firmware mf642cdw_firmware mf746cdw_firmware i-sensys_x_c1127p_firmware mf273dw i-sensys_x_c1127i_firmware imageprograf_tc-20 i-sensys_lbp621cw i-sensys_x_c1127if i-sensys_x_c1127if_firmware mf272dw_firmware mf644cdw i-sensys_lbp664cx lbp664cdw_firmware pixma_g4270 pixma_g3270 i-sensys_mf645cx i-sensys_lbp633cdw_firmware i-sensys_mf744cdw_firmware lbp623cdw_firmware pixma_g4270_firmware lbp622c pixma_g3270_firmware i-sensys_mf643cdw_firmware maxify_gx4020_firmware i-sensys_lbp621cw_firmware mf272dw mf641cw_firmware lbp622cdw lbp664c_firmware i-sensys_lbp633cdw mf264dw_ii mf642cdw mf264dw_ii_firmware lbp662c lbp621c i-sensys_mf742cdw_firmware mf262dw_ii_firmware lbp122dw_firmware lbp661c i-sensys_mf742cdw mf743cdw_firmware lbp664cdw mf269dw_ii_firmware i-sensys_mf643cdw mf269dw_vp_ii i-sensys_lbp664cx_firmware mf275dw_firmware lbp664c mf267dw_ii maxify_gx3020_firmware mf741cdw lbp623cdw Canon Office/Small Office Multifunction Printers and Laser Printers

CWE ID-CWE-121

Stack-based Buffer Overflow

CWE ID-CWE-787

Out-of-bounds Write

CVE-2023-0854

Matching Score-10

Assigner-Canon Inc.

View Details

Matching Score-10

Assigner-Canon Inc.

CVSS Score-9.8||CRITICAL

EPSS-0.28% / 51.29%

||

7 Day CHG-0.07%

Published-11 May, 2023 | 00:00

Updated-10 Feb, 2025 | 20:59

Buffer overflow in NetBIOS QNAME registering and communication process of Office / Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code. *:Satera LBP660C Series/LBP620C Series/MF740C Series/MF640C Series firmware Ver.11.04 and earlier sold in Japan. Color imageCLASS LBP660C Series/LBP 620C Series/X LBP1127C/MF740C Series/MF640C Series/X MF1127C firmware Ver.11.04 and earlier sold in US. i-SENSYS LBP660C Series/LBP620C Series/MF740C Series/MF640C Series, C1127P, C1127iF, C1127i firmware Ver.11.04 and earlier sold in Europe.

Vendor-Canon Inc.

Product-i-sensys_x_c1127i i-sensys_mf645cx_firmware mf741cdw_firmware i-sensys_x_c1127p mf745cdw imageprograf_tc-20m i-sensys_mf746cx_firmware mf273dw_firmware i-sensys_mf641cw_firmware mf641cw imageprograf_tc-20m_firmware mf1127c_firmware i-sensys_mf641cw i-sensys_lbp623cdw lbp1127c mf275dw lbp621c_firmware maxify_gx4020 lbp122dw mf262dw_ii lbp622cdw_firmware i-sensys_lbp623cdw_firmware mf743cdw lbp661c_firmware maxify_gx3020 mf746cdw mf644cdw_firmware mf267dw_ii_firmware lbp1127c_firmware mf1127c lbp622c_firmware mf269dw_ii mf745cdw_firmware i-sensys_mf746cx imageprograf_tc-20_firmware i-sensys_mf744cdw mf269dw_vp_ii_firmware lbp662c_firmware mf642cdw_firmware mf746cdw_firmware i-sensys_x_c1127p_firmware mf273dw i-sensys_x_c1127i_firmware imageprograf_tc-20 i-sensys_lbp621cw i-sensys_x_c1127if i-sensys_x_c1127if_firmware mf272dw_firmware mf644cdw i-sensys_lbp664cx lbp664cdw_firmware pixma_g4270 pixma_g3270 i-sensys_mf645cx i-sensys_lbp633cdw_firmware i-sensys_mf744cdw_firmware lbp623cdw_firmware pixma_g4270_firmware lbp622c pixma_g3270_firmware i-sensys_mf643cdw_firmware maxify_gx4020_firmware i-sensys_lbp621cw_firmware mf272dw mf641cw_firmware lbp622cdw lbp664c_firmware i-sensys_lbp633cdw mf264dw_ii mf642cdw mf264dw_ii_firmware lbp662c lbp621c i-sensys_mf742cdw_firmware mf262dw_ii_firmware lbp122dw_firmware lbp661c i-sensys_mf742cdw mf743cdw_firmware lbp664cdw mf269dw_ii_firmware i-sensys_mf643cdw mf269dw_vp_ii i-sensys_lbp664cx_firmware mf275dw_firmware lbp664c mf267dw_ii maxify_gx3020_firmware mf741cdw lbp623cdw Canon Office/Small Office Multifunction Printers and Laser Printers

CWE ID-CWE-122

Heap-based Buffer Overflow

CWE ID-CWE-787

Out-of-bounds Write

CVE-2023-0853

Matching Score-10

Assigner-Canon Inc.

View Details

Matching Score-10

Assigner-Canon Inc.

CVSS Score-9.8||CRITICAL

EPSS-0.30% / 53.65%

||

7 Day CHG-0.07%

Published-11 May, 2023 | 00:00

Updated-10 Feb, 2025 | 20:57

Buffer overflow in mDNS NSEC record registering process of Office / Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code. *:Satera LBP660C Series/LBP620C Series/MF740C Series/MF640C Series firmware Ver.11.04 and earlier sold in Japan. Color imageCLASS LBP660C Series/LBP 620C Series/X LBP1127C/MF740C Series/MF640C Series/X MF1127C firmware Ver.11.04 and earlier sold in US. i-SENSYS LBP660C Series/LBP620C Series/MF740C Series/MF640C Series, C1127P, C1127iF, C1127i firmware Ver.11.04 and earlier sold in Europe.

Vendor-Canon Inc.

Product-i-sensys_x_c1127i i-sensys_mf645cx_firmware mf741cdw_firmware i-sensys_x_c1127p mf745cdw imageprograf_tc-20m i-sensys_mf746cx_firmware mf273dw_firmware i-sensys_mf641cw_firmware mf641cw imageprograf_tc-20m_firmware mf1127c_firmware i-sensys_mf641cw i-sensys_lbp623cdw lbp1127c mf275dw lbp621c_firmware maxify_gx4020 lbp122dw mf262dw_ii lbp622cdw_firmware i-sensys_lbp623cdw_firmware mf743cdw lbp661c_firmware maxify_gx3020 mf746cdw mf644cdw_firmware mf267dw_ii_firmware lbp1127c_firmware mf1127c lbp622c_firmware mf269dw_ii mf745cdw_firmware i-sensys_mf746cx imageprograf_tc-20_firmware i-sensys_mf744cdw mf269dw_vp_ii_firmware lbp662c_firmware mf642cdw_firmware mf746cdw_firmware i-sensys_x_c1127p_firmware mf273dw i-sensys_x_c1127i_firmware imageprograf_tc-20 i-sensys_lbp621cw i-sensys_x_c1127if i-sensys_x_c1127if_firmware mf272dw_firmware mf644cdw i-sensys_lbp664cx lbp664cdw_firmware pixma_g4270 pixma_g3270 i-sensys_mf645cx i-sensys_lbp633cdw_firmware i-sensys_mf744cdw_firmware lbp623cdw_firmware pixma_g4270_firmware lbp622c pixma_g3270_firmware i-sensys_mf643cdw_firmware maxify_gx4020_firmware i-sensys_lbp621cw_firmware mf272dw mf641cw_firmware lbp622cdw lbp664c_firmware i-sensys_lbp633cdw mf264dw_ii mf642cdw mf264dw_ii_firmware lbp662c lbp621c i-sensys_mf742cdw_firmware mf262dw_ii_firmware lbp122dw_firmware lbp661c i-sensys_mf742cdw mf743cdw_firmware lbp664cdw mf269dw_ii_firmware i-sensys_mf643cdw mf269dw_vp_ii i-sensys_lbp664cx_firmware mf275dw_firmware lbp664c mf267dw_ii maxify_gx3020_firmware mf741cdw lbp623cdw Canon Office/Small Office Multifunction Printers and Laser Printers

CWE ID-CWE-121

Stack-based Buffer Overflow

CWE ID-CWE-787

Out-of-bounds Write

CVE-2023-0855

Matching Score-10

Assigner-Canon Inc.

View Details

Matching Score-10

Assigner-Canon Inc.

CVSS Score-9.8||CRITICAL

EPSS-0.28% / 51.29%

||

7 Day CHG-0.07%

Published-11 May, 2023 | 00:00

Updated-10 Feb, 2025 | 20:58

Buffer overflow in IPP number-up attribute process of Office / Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code. *:Satera LBP660C Series/LBP620C Series/MF740C Series/MF640C Series firmware Ver.11.04 and earlier sold in Japan. Color imageCLASS LBP660C Series/LBP 620C Series/X LBP1127C/MF740C Series/MF640C Series/X MF1127C firmware Ver.11.04 and earlier sold in US. i-SENSYS LBP660C Series/LBP620C Series/MF740C Series/MF640C Series, C1127P, C1127iF, C1127i firmware Ver.11.04 and earlier sold in Europe.

Vendor-Canon Inc.

Product-i-sensys_x_c1127i i-sensys_mf645cx_firmware mf741cdw_firmware i-sensys_x_c1127p mf745cdw imageprograf_tc-20m i-sensys_mf746cx_firmware mf273dw_firmware i-sensys_mf641cw_firmware mf641cw imageprograf_tc-20m_firmware mf1127c_firmware i-sensys_mf641cw i-sensys_lbp623cdw lbp1127c mf275dw lbp621c_firmware maxify_gx4020 lbp122dw mf262dw_ii lbp622cdw_firmware i-sensys_lbp623cdw_firmware mf743cdw lbp661c_firmware maxify_gx3020 mf746cdw mf644cdw_firmware mf267dw_ii_firmware lbp1127c_firmware mf1127c lbp622c_firmware mf269dw_ii mf745cdw_firmware i-sensys_mf746cx imageprograf_tc-20_firmware i-sensys_mf744cdw mf269dw_vp_ii_firmware lbp662c_firmware mf642cdw_firmware mf746cdw_firmware i-sensys_x_c1127p_firmware mf273dw i-sensys_x_c1127i_firmware imageprograf_tc-20 i-sensys_lbp621cw i-sensys_x_c1127if i-sensys_x_c1127if_firmware mf272dw_firmware mf644cdw i-sensys_lbp664cx lbp664cdw_firmware pixma_g4270 pixma_g3270 i-sensys_mf645cx i-sensys_lbp633cdw_firmware i-sensys_mf744cdw_firmware lbp623cdw_firmware pixma_g4270_firmware lbp622c pixma_g3270_firmware i-sensys_mf643cdw_firmware maxify_gx4020_firmware i-sensys_lbp621cw_firmware mf272dw mf641cw_firmware lbp622cdw lbp664c_firmware i-sensys_lbp633cdw mf264dw_ii mf642cdw mf264dw_ii_firmware lbp662c lbp621c i-sensys_mf742cdw_firmware mf262dw_ii_firmware lbp122dw_firmware lbp661c i-sensys_mf742cdw mf743cdw_firmware lbp664cdw mf269dw_ii_firmware i-sensys_mf643cdw mf269dw_vp_ii i-sensys_lbp664cx_firmware mf275dw_firmware lbp664c mf267dw_ii maxify_gx3020_firmware mf741cdw lbp623cdw Canon Office/Small Office Multifunction Printers and Laser Printers

CWE ID-CWE-121

Stack-based Buffer Overflow

CWE ID-CWE-787

Out-of-bounds Write

CVE-2025-2146

Matching Score-10

Assigner-Canon Inc.

View Details

Matching Score-10

Assigner-Canon Inc.

CVSS Score-9.8||CRITICAL

EPSS-0.63% / 70.32%

||

7 Day CHG~0.00%

Published-25 May, 2025 | 23:36

Updated-03 Jun, 2025 | 15:49

Buffer overflow in WebService Authentication processing of Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code. *: Satera MF656Cdw/Satera MF654Cdw/Satera MF551dw/Satera MF457dw firmware v05.07 and earlier sold in Japan. Color imageCLASS MF656Cdw/Color imageCLASS MF654Cdw/Color imageCLASS MF653Cdw/Color imageCLASS MF652Cdw/Color imageCLASS LBP633Cdw/Color imageCLASS LBP632Cdw/imageCLASS MF455dw/imageCLASS MF453dw/imageCLASS MF452dw/imageCLASS MF451dw/imageCLASS LBP237dw/imageCLASS LBP236dw/imageCLASS X MF1238 II/imageCLASS X MF1643i II/imageCLASS X MF1643iF II/imageCLASS X LBP1238 II firmware v05.07 and earlier sold in US. i-SENSYS MF657Cdw/i-SENSYS MF655Cdw/i-SENSYS MF651Cdw/i-SENSYS LBP633Cdw/i-SENSYS LBP631Cdw/i-SENSYS MF553dw/i-SENSYS MF552dw/i-SENSYS MF455dw/i-SENSYS MF453dw/i-SENSYS LBP236dw/i-SENSYS LBP233dw/imageRUNNER 1643iF II/imageRUNNER 1643i II/i-SENSYS X 1238iF II/i-SENSYS X 1238i II/i-SENSYS X 1238P II/i-SENSYS X 1238Pr II firmware v05.07 and earlier sold in Europe.

Vendor-Canon Inc.

Product-imageclass_mf653cdw_firmware imagerunner_1643if_ii imageclass_mf656cdw_firmware i-sensys_lbp233dw_firmware i-sensys_mf453dw satera_mf457dw i-sensys_mf655cdw_firmware i-sensys_lbp233dw i-sensys_mf657cdw_firmware i-sensys_x_1238pr_ii_firmware imageclass_mf455dw_firmware i-sensys_lbp631cdw_firmware imageclass_mf451dw_firmware i-sensys_mf651cdw_firmware i-sensys_mf552dw_firmware imageclass_mf452dw_firmware i-sensys_mf455dw_firmware imageclass_x_mf1643i_ii imageclass_mf455dw satera_mf551dw i-sensys_x_1238p_ii imageclass_mf653cdw i-sensys_lbp236dw_firmware i-sensys_mf455dw imageclass_x_lbp1238_ii imageclass_lbp632cdw_firmware satera_mf656cdw_firmware imageclass_mf652cdw_firmware imageclass_mf451dw imageclass_lbp236dw imageclass_mf452dw i-sensys_x_1238pr_ii imageclass_x_mf1643if_ii i-sensys_lbp633cdw_firmware imageclass_lbp237dw_firmware imagerunner_1643if_ii_firmware i-sensys_mf657cdw i-sensys_lbp236dw i-sensys_x_1238p_ii_firmware imageclass_mf453dw_firmware i-sensys_mf651cdw i-sensys_mf453dw_firmware i-sensys_x_1238if_ii i-sensys_lbp631cdw satera_mf551dw_firmware imageclass_x_mf1238_ii satera_mf654cdw imagerunner_1643i_ii imageclass_mf652cdw i-sensys_mf553dw_firmware imageclass_mf656cdw i-sensys_lbp633cdw imagerunner_1643i_ii_firmware i-sensys_x_1238i_ii_firmware imageclass_x_mf1238_ii_firmware imageclass_lbp237dw imageclass_x_mf1643i_ii_firmware imageclass_mf654cdw_firmware imageclass_mf654cdw i-sensys_mf553dw i-sensys_x_1238if_ii_firmware satera_mf654cdw_firmware i-sensys_x_1238i_ii imageclass_mf453dw imageclass_lbp633cdw imageclass_x_lbp1238_ii_firmware imageclass_lbp633cdw_firmware satera_mf656cdw imageclass_x_mf1643if_ii_firmware satera_mf457dw_firmware imageclass_lbp236dw_firmware imageclass_lbp632cdw i-sensys_mf655cdw i-sensys_mf552dw imageCLASS MF453dw Satera MF457dw imageCLASS MF455dw i-SENSYS MF655Cdw i-SENSYS MF455dw i-SENSYS X 1238P II imageCLASS X MF1643i II imageCLASS X MF1643iF II i-SENSYS MF453dw Color imageCLASS MF656Cdw imageCLASS X MF1238 II i-SENSYS X 1238iF II imageCLASS MF451dw Color imageCLASS MF654Cdw i-SENSYS MF651Cdw i-SENSYS MF553dw i-SENSYS MF552dw imageCLASS LBP237dw Color imageCLASS MF653Cdw imageRUNNER 1643iF II i-SENSYS LBP233dw Color imageCLASS LBP633Cdw i-SENSYS X 1238Pr II Color imageCLASS MF652Cdw i-SENSYS X 1238i II Color imageCLASS LBP632Cdw i-SENSYS LBP633Cdw imageCLASS MF452dw i-SENSYS LBP236dw Satera MF551dw i-SENSYS MF657Cdw Satera MF656Cdw imageCLASS LBP236dw Satera MF654Cdw imageCLASS X LBP1238 II i-SENSYS LBP631Cdw imageRUNNER 1643i II

CWE ID-CWE-787

Out-of-bounds Write

CVE-2025-14237

Matching Score-10

Assigner-Canon Inc.

View Details

Matching Score-10

Assigner-Canon Inc.

CVSS Score-9.3||CRITICAL

EPSS-0.07% / 20.14%

||

7 Day CHG~0.00%

Published-15 Jan, 2026 | 23:40

Updated-26 Feb, 2026 | 15:04

Buffer overflow in XPS font parse processing on Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code. *: Satera LBP670C Series/Satera MF750C Series firmware v06.02 and earlier sold in Japan.Color imageCLASS LBP630C/Color imageCLASS MF650C Series/imageCLASS LBP230 Series/imageCLASS X LBP1238 II/imageCLASS MF450 Series/imageCLASS X MF1238 II/imageCLASS X MF1643i II/imageCLASS X MF1643iF II firmware v06.02 and earlier sold in US.i-SENSYS LBP630C Series/i-SENSYS MF650C Series/i-SENSYS LBP230 Series/1238P II/1238Pr II/i-SENSYS MF450 Series/i-SENSYS MF550 Series/1238i II/1238iF II/imageRUNNER 1643i II/imageRUNNER 1643iF II firmware v06.02 and earlier sold in Europe.

Vendor-Canon Inc.

CWE ID-CWE-787

Out-of-bounds Write

CVE-2025-14236

Matching Score-10

Assigner-Canon Inc.

View Details

Matching Score-10

Assigner-Canon Inc.

CVSS Score-9.3||CRITICAL

EPSS-0.07% / 20.14%

||

7 Day CHG~0.00%

Published-15 Jan, 2026 | 23:39

Updated-26 Feb, 2026 | 15:04

Buffer overflow in Address Book attribute tag processing on Small Office Multifunction Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code. *: Satera LBP670C Series/Satera MF750C Series firmware v06.02 and earlier sold in Japan.Color imageCLASS LBP630C/Color imageCLASS MF650C Series/imageCLASS LBP230 Series/imageCLASS X LBP1238 II/imageCLASS MF450 Series/imageCLASS X MF1238 II/imageCLASS X MF1643i II/imageCLASS X MF1643iF II firmware v06.02 and earlier sold in US.i-SENSYS LBP630C Series/i-SENSYS MF650C Series/i-SENSYS LBP230 Series/1238P II/1238Pr II/i-SENSYS MF450 Series/i-SENSYS MF550 Series/1238i II/1238iF II/imageRUNNER 1643i II/imageRUNNER 1643iF II firmware v06.02 and earlier sold in Europe.

Vendor-Canon Inc.

CWE ID-CWE-787

Out-of-bounds Write

CVE-2025-14232

Matching Score-10

Assigner-Canon Inc.

View Details

Matching Score-10

Assigner-Canon Inc.

CVSS Score-9.3||CRITICAL

EPSS-0.07% / 20.14%

||

7 Day CHG~0.00%

Published-15 Jan, 2026 | 23:36

Updated-26 Feb, 2026 | 15:04

Buffer overflow in XML processing of XPS file in Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code. *: Satera LBP670C Series/Satera MF750C Series firmware v06.02 and earlier sold in Japan.Color imageCLASS LBP630C/Color imageCLASS MF650C Series/imageCLASS LBP230 Series/imageCLASS X LBP1238 II/imageCLASS MF450 Series/imageCLASS X MF1238 II/imageCLASS X MF1643i II/imageCLASS X MF1643iF II firmware v06.02 and earlier sold in US.i-SENSYS LBP630C Series/i-SENSYS MF650C Series/i-SENSYS LBP230 Series/1238P II/1238Pr II/i-SENSYS MF450 Series/i-SENSYS MF550 Series/1238i II/1238iF II/imageRUNNER 1643i II/imageRUNNER 1643iF II firmware v06.02 and earlier sold in Europe.

Vendor-Canon Inc.

CWE ID-CWE-787

Out-of-bounds Write

CVE-2025-14231

Matching Score-10

Assigner-Canon Inc.

View Details

Matching Score-10

Assigner-Canon Inc.

CVSS Score-9.3||CRITICAL

EPSS-0.07% / 20.14%

||

7 Day CHG~0.00%

Published-15 Jan, 2026 | 23:35

Updated-26 Feb, 2026 | 15:04

Buffer overflow in print job processing by WSD on Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code. *: Satera LBP670C Series/Satera MF750C Series firmware v06.02 and earlier sold in Japan.Color imageCLASS LBP630C/Color imageCLASS MF650C Series/imageCLASS LBP230 Series/imageCLASS X LBP1238 II/imageCLASS MF450 Series/imageCLASS X MF1238 II/imageCLASS X MF1643i II/imageCLASS X MF1643iF II firmware v06.02 and earlier sold in US.i-SENSYS LBP630C Series/i-SENSYS MF650C Series/i-SENSYS LBP230 Series/1238P II/1238Pr II/i-SENSYS MF450 Series/i-SENSYS MF550 Series/1238i II/1238iF II/imageRUNNER 1643i II/imageRUNNER 1643iF II firmware v06.02 and earlier sold in Europe.

Vendor-Canon Inc.

CWE ID-CWE-787

Out-of-bounds Write

CVE-2024-2184

Matching Score-10

Assigner-Canon Inc.

View Details

Matching Score-10

Assigner-Canon Inc.

CVSS Score-9.8||CRITICAL

EPSS-0.13% / 32.26%

||

7 Day CHG~0.00%

Published-11 Mar, 2024 | 00:26

Updated-15 Apr, 2026 | 00:35

Buffer overflow in identifier field of WSD probe request process of Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code.*:Satera MF740C Series/Satera MF640C Series/Satera LBP660C Series/Satera LBP620C Series firmware v12.07 and earlier, and Satera MF750C Series/Satera LBP670C Series firmware v03.09 and earlier sold in Japan.Color imageCLASS MF740C Series/Color imageCLASS MF640C Series/Color imageCLASS X MF1127C/Color imageCLASS LBP664Cdw/Color imageCLASS LBP622Cdw/Color imageCLASS X LBP1127C firmware v12.07 and earlier, and Color imageCLASS MF750C Series/Color imageCLASS X MF1333C/Color imageCLASS LBP674Cdw/Color imageCLASS X LBP1333C firmware v03.09 and earlier sold in US.i-SENSYS MF740C Series/i-SENSYS MF640C Series/C1127i Series/i-SENSYS LBP660C Series/i-SENSYS LBP620C Series/C1127P firmware v12.07 and earlier, and i-SENSYS MF750C Series/C1333i Series/i-SENSYS LBP673Cdw/C1333P firmware v03.09 and earlier sold in Europe.

Vendor-Canon Inc.

Product-Satera LBP660C Series i-SENSYS MF740C Series C1127i Series Satera LBP620C Series i-SENSYS MF750C Series Color imageCLASS MF640C Series i-SENSYS MF640C Series Satera MF740C Series i-SENSYS LBP673Cdw C1333i Series Color imageCLASS MF740C Series i-SENSYS LBP620C Series Color imageCLASS LBP664Cdw Color imageCLASS MF750C Series Satera MF640C Series Color imageCLASS X LBP1127C Color imageCLASS X MF1333C C1127P C1333P Color imageCLASS X MF1127C Satera LBP670C Series Color imageCLASS X LBP1333C Color imageCLASS LBP622Cdw i-SENSYS LBP660C Series Color imageCLASS LBP674Cdw Satera MF750C Series c1127i_series i-sensys_mf750c_series c1333i_series i-sensys_mf640c_series satera_lbp670c_series color_imageclass_lbp622cdw satera_mf740c_series color_imageclass_x_lbp1127c color_imageclass_mf750c_series color_imageclass_mf640c_series c1127p color_imageclass_x_mf1333c satera_mf640c_series i-sensys_lbp660c_series color_imageclass_x_lbp1333c i-sensys_lbp673cdw satera_mf750c_series color_imageclass_lbp664cdw satera_lbp660c_series satera_lbp620c_series i-sensys_lbp620c_series color_imageclass_mf740c_series color_imageclass_x_mf1127c color_imageclass_lbp674cdw c1333p i-sensys_mf740c_series

CWE ID-CWE-787

Out-of-bounds Write

CVE-2024-12648

Matching Score-10

Assigner-Canon Inc.

View Details

Matching Score-10

Assigner-Canon Inc.

CVSS Score-9.8||CRITICAL

EPSS-0.31% / 53.78%

||

7 Day CHG~0.00%

Published-28 Jan, 2025 | 00:39

Updated-26 Jan, 2026 | 15:08

Buffer overflow in TIFF data EXIF tag processing of Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code. *: Satera MF656Cdw/Satera MF654Cdw firmware v05.04 and earlier sold in Japan. Color imageCLASS MF656Cdw/Color imageCLASS MF654Cdw/Color imageCLASS MF653Cdw/Color imageCLASS MF652Cdw/Color imageCLASS LBP633Cdw/Color imageCLASS LBP632Cdw firmware v05.04 and earlier sold in US. i-SENSYS MF657Cdw/i-SENSYS MF655Cdw/i-SENSYS MF651Cdw/i-SENSYS LBP633Cdw/i-SENSYS LBP631Cdw firmware v05.04 and earlier sold in Europe.

Vendor-Canon Inc.

CWE ID-CWE-787

Out-of-bounds Write

CVE-2024-12649

Matching Score-10

Assigner-Canon Inc.

View Details

Matching Score-10

Assigner-Canon Inc.

CVSS Score-9.8||CRITICAL

EPSS-0.31% / 53.78%

||

7 Day CHG~0.00%

Published-28 Jan, 2025 | 00:39

Updated-26 Jan, 2026 | 15:08

Buffer overflow in XPS data font processing of Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code. *: Satera MF656Cdw/Satera MF654Cdw firmware v05.04 and earlier sold in Japan. Color imageCLASS MF656Cdw/Color imageCLASS MF654Cdw/Color imageCLASS MF653Cdw/Color imageCLASS MF652Cdw/Color imageCLASS LBP633Cdw/Color imageCLASS LBP632Cdw firmware v05.04 and earlier sold in US. i-SENSYS MF657Cdw/i-SENSYS MF655Cdw/i-SENSYS MF651Cdw/i-SENSYS LBP633Cdw/i-SENSYS LBP631Cdw firmware v05.04 and earlier sold in Europe.

Vendor-Canon Inc.

CWE ID-CWE-787

Out-of-bounds Write

CVE-2024-12647

Matching Score-10

Assigner-Canon Inc.

View Details

Matching Score-10

Assigner-Canon Inc.

CVSS Score-9.8||CRITICAL

EPSS-0.31% / 53.78%

||

7 Day CHG~0.00%

Published-28 Jan, 2025 | 00:38

Updated-26 Jan, 2026 | 15:08

Buffer overflow in CPCA font download processing of Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code. *: Satera MF656Cdw/Satera MF654Cdw firmware v05.04 and earlier sold in Japan. Color imageCLASS MF656Cdw/Color imageCLASS MF654Cdw/Color imageCLASS MF653Cdw/Color imageCLASS MF652Cdw/Color imageCLASS LBP633Cdw/Color imageCLASS LBP632Cdw firmware v05.04 and earlier sold in US. i-SENSYS MF657Cdw/i-SENSYS MF655Cdw/i-SENSYS MF651Cdw/i-SENSYS LBP633Cdw/i-SENSYS LBP631Cdw firmware v05.04 and earlier sold in Europe.

Vendor-Canon Inc.

CWE ID-CWE-787

Out-of-bounds Write

CVE-2023-6231

Matching Score-10

Assigner-Canon Inc.

View Details

Matching Score-10

Assigner-Canon Inc.

CVSS Score-9.8||CRITICAL

EPSS-0.31% / 54.53%

||

7 Day CHG~0.00%

Published-06 Feb, 2024 | 00:22

Updated-17 Jun, 2025 | 21:29

Buffer overflow in WSD probe request process of Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code.*: Satera LBP670C Series/Satera MF750C Series firmware v03.07 and earlier sold in Japan. Color imageCLASS LBP674C/Color imageCLASS X LBP1333C/Color imageCLASS MF750C Series/Color imageCLASS X MF1333C Series firmware v03.07 and earlier sold in US. i-SENSYS LBP673Cdw/C1333P/i-SENSYS MF750C Series/C1333i Series firmware v03.07 and earlier sold in Europe.

Vendor-Canon Inc.

Product-i-sensys_mf754cdw_firmware mf751cdw mf273dw_firmware lbp671c mf1238_ii lbp672c_firmware mf1643i_ii_firmware i-sensys_x_c1333i_firmware mf1333c lbp236dw_firmware mf275dw i-sensys_x_c1333p_firmware lbp122dw i-sensys_x_c1333i mf1643if_ii mf272dw lbp671c_firmware mf451dw_firmware lbp674cdw lbp672c i-sensys_mf754cdw mf1333c_firmware mf753cdw i-sensys_x_c1333if_firmware i-sensys_mf752cdw i-sensys_x_c1333p mf453dw mf452dw mf455dw_firmware lbp1333c_firmware lbp122dw_firmware lbp674c_firmware mf455dw mf755cdw_firmware mf452dw_firmware mf451dw lbp237dw_firmware mf753cdw_firmware lbp674cdw_firmware i-sensys_x_c1333if i-sensys_lbp673cdw_firmware i-sensys_lbp673cdw mf273dw lbp1238_ii mf275dw_firmware lbp1238_ii_firmware lbp1333c mf755cdw mf453dw_firmware mf1238_ii_firmware lbp236dw i-sensys_mf752cdw_firmware mf751cdw_firmware mf272dw_firmware lbp674c mf1643if_ii_firmware lbp237dw mf1643i_ii Satera LBP670C Series Color imageCLASS MF750C Series C1333i Series Color imageCLASS LBP674C Color imageCLASS X MF1333C Series Satera MF750C Series i-SENSYS LBP673Cdw i-SENSYS MF750C Series Color imageCLASS X LBP1333C C1333P

CWE ID-CWE-787

Out-of-bounds Write

CVE-2023-6229

Matching Score-10

Assigner-Canon Inc.

View Details

Matching Score-10

Assigner-Canon Inc.

CVSS Score-9.8||CRITICAL

EPSS-0.49% / 65.66%

||

7 Day CHG~0.00%

Published-06 Feb, 2024 | 00:20

Updated-17 Jun, 2025 | 21:29

Buffer overflow in CPCA PDL Resource Download process of Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code.*: Satera LBP670C Series/Satera MF750C Series firmware v03.07 and earlier sold in Japan. Color imageCLASS LBP674C/Color imageCLASS X LBP1333C/Color imageCLASS MF750C Series/Color imageCLASS X MF1333C Series firmware v03.07 and earlier sold in US. i-SENSYS LBP673Cdw/C1333P/i-SENSYS MF750C Series/C1333i Series firmware v03.07 and earlier sold in Europe.

Vendor-Canon Inc.

Product-i-sensys_mf754cdw_firmware mf751cdw mf273dw_firmware lbp671c mf1238_ii lbp672c_firmware mf1643i_ii_firmware i-sensys_x_c1333i_firmware mf1333c lbp236dw_firmware mf275dw i-sensys_x_c1333p_firmware lbp122dw i-sensys_x_c1333i mf1643if_ii mf272dw lbp671c_firmware mf451dw_firmware lbp674cdw lbp672c i-sensys_mf754cdw mf1333c_firmware mf753cdw i-sensys_x_c1333if_firmware i-sensys_mf752cdw i-sensys_x_c1333p mf453dw mf452dw mf455dw_firmware lbp1333c_firmware lbp122dw_firmware lbp674c_firmware mf455dw mf755cdw_firmware mf452dw_firmware mf451dw lbp237dw_firmware mf753cdw_firmware lbp674cdw_firmware i-sensys_x_c1333if i-sensys_lbp673cdw_firmware i-sensys_lbp673cdw mf273dw lbp1238_ii mf275dw_firmware lbp1238_ii_firmware lbp1333c mf755cdw mf453dw_firmware mf1238_ii_firmware lbp236dw i-sensys_mf752cdw_firmware mf751cdw_firmware mf272dw_firmware lbp674c mf1643if_ii_firmware lbp237dw mf1643i_ii Satera LBP670C Series Color imageCLASS MF750C Series C1333i Series Color imageCLASS LBP674C Color imageCLASS X MF1333C Series Satera MF750C Series i-SENSYS LBP673Cdw i-SENSYS MF750C Series Color imageCLASS X LBP1333C C1333P

CWE ID-CWE-787

Out-of-bounds Write

CVE-2023-6230

Matching Score-10

Assigner-Canon Inc.

View Details

Matching Score-10

Assigner-Canon Inc.

CVSS Score-9.8||CRITICAL

EPSS-0.36% / 58.41%

||

7 Day CHG~0.00%

Published-06 Feb, 2024 | 00:21

Updated-17 Jun, 2025 | 21:29

Buffer overflow in the Address Book password process in authentication of Mobile Device Function of Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code.*: Satera LBP670C Series/Satera MF750C Series firmware v03.07 and earlier sold in Japan. Color imageCLASS LBP674C/Color imageCLASS X LBP1333C/Color imageCLASS MF750C Series/Color imageCLASS X MF1333C Series firmware v03.07 and earlier sold in US. i-SENSYS LBP673Cdw/C1333P/i-SENSYS MF750C Series/C1333i Series firmware v03.07 and earlier sold in Europe.

Vendor-Canon Inc.

Product-i-sensys_mf754cdw_firmware mf751cdw mf273dw_firmware lbp671c mf1238_ii lbp672c_firmware mf1643i_ii_firmware i-sensys_x_c1333i_firmware mf1333c lbp236dw_firmware mf275dw i-sensys_x_c1333p_firmware lbp122dw i-sensys_x_c1333i mf1643if_ii mf272dw lbp671c_firmware mf451dw_firmware lbp674cdw lbp672c i-sensys_mf754cdw mf1333c_firmware mf753cdw i-sensys_x_c1333if_firmware i-sensys_mf752cdw i-sensys_x_c1333p mf453dw mf452dw mf455dw_firmware lbp1333c_firmware lbp122dw_firmware lbp674c_firmware mf455dw mf755cdw_firmware mf452dw_firmware mf451dw lbp237dw_firmware mf753cdw_firmware lbp674cdw_firmware i-sensys_x_c1333if i-sensys_lbp673cdw_firmware i-sensys_lbp673cdw mf273dw lbp1238_ii mf275dw_firmware lbp1238_ii_firmware lbp1333c mf755cdw mf453dw_firmware mf1238_ii_firmware lbp236dw i-sensys_mf752cdw_firmware mf751cdw_firmware mf272dw_firmware lbp674c mf1643if_ii_firmware lbp237dw mf1643i_ii Satera LBP670C Series Color imageCLASS MF750C Series C1333i Series Color imageCLASS LBP674C Color imageCLASS X MF1333C Series Satera MF750C Series i-SENSYS LBP673Cdw i-SENSYS MF750C Series Color imageCLASS X LBP1333C C1333P

CWE ID-CWE-787

Out-of-bounds Write

CVE-2023-6233

Matching Score-10

Assigner-Canon Inc.

View Details

Matching Score-10

Assigner-Canon Inc.

CVSS Score-9.8||CRITICAL

EPSS-0.31% / 54.53%

||

7 Day CHG~0.00%

Published-06 Feb, 2024 | 00:23

Updated-17 Jun, 2025 | 21:29

Buffer overflow in SLP attribute request process of Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code.*: Satera LBP670C Series/Satera MF750C Series firmware v03.07 and earlier sold in Japan. Color imageCLASS LBP674C/Color imageCLASS X LBP1333C/Color imageCLASS MF750C Series/Color imageCLASS X MF1333C Series firmware v03.07 and earlier sold in US. i-SENSYS LBP673Cdw/C1333P/i-SENSYS MF750C Series/C1333i Series firmware v03.07 and earlier sold in Europe.

Vendor-Canon Inc.

Product-i-sensys_mf754cdw_firmware mf751cdw mf273dw_firmware lbp671c mf1238_ii lbp672c_firmware mf1643i_ii_firmware i-sensys_x_c1333i_firmware mf1333c lbp236dw_firmware mf275dw i-sensys_x_c1333p_firmware lbp122dw i-sensys_x_c1333i mf1643if_ii mf272dw lbp671c_firmware mf451dw_firmware lbp674cdw lbp672c i-sensys_mf754cdw mf1333c_firmware mf753cdw i-sensys_x_c1333if_firmware i-sensys_mf752cdw i-sensys_x_c1333p mf453dw mf452dw mf455dw_firmware lbp1333c_firmware lbp122dw_firmware lbp674c_firmware mf455dw mf755cdw_firmware mf452dw_firmware mf451dw lbp237dw_firmware mf753cdw_firmware lbp674cdw_firmware i-sensys_x_c1333if i-sensys_lbp673cdw_firmware i-sensys_lbp673cdw mf273dw lbp1238_ii mf275dw_firmware lbp1238_ii_firmware lbp1333c mf755cdw mf453dw_firmware mf1238_ii_firmware lbp236dw i-sensys_mf752cdw_firmware mf751cdw_firmware mf272dw_firmware lbp674c mf1643if_ii_firmware lbp237dw mf1643i_ii Satera LBP670C Series Color imageCLASS MF750C Series C1333i Series Color imageCLASS LBP674C Color imageCLASS X MF1333C Series Satera MF750C Series i-SENSYS LBP673Cdw i-SENSYS MF750C Series Color imageCLASS X LBP1333C C1333P

CWE ID-CWE-787

Out-of-bounds Write

CVE-2022-24673

Matching Score-10

Assigner-Zero Day Initiative

View Details

Matching Score-10

Assigner-Zero Day Initiative

CVSS Score-8.8||HIGH

EPSS-8.19% / 92.24%

||

7 Day CHG~0.00%

Published-28 Mar, 2023 | 00:00

Updated-19 Feb, 2025 | 15:39

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Canon imageCLASS MF644Cdw 10.02 printers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the implementation of the SLP protocol. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-15845.

Vendor-Canon Inc.

Product-mf741cdw_firmware mf735cdw_firmware d1550_firmware mf6180dw mf641cw mf424dw_firmware mf1643i_ii_firmware mf1238_firmware lbp228dw_firmware mf543dw_firmware mf634cdw_firmware mf1238 mf451dw_firmware mf624cdw_firmware mf733cdw mf743cdw mf735cdw lbp612cdw mf746cdw 1435if\+mf448dw mf448dw_firmware mf6160dw_firmware mf644cdw_firmware lbp1127c_firmware d1650_firmware wg7250z_firmware mf632cdw 1435if\+_firmware lbp228dw lbp253dw_firmware mf445dw lbp227dw mf6160dw mf642cdw_firmware lbp1238 lbp654cdw mf416dw_firmware mf453dw_firmware mf1238_ii_firmware lbp214dw lbp227dw_firmware ir1435i mf644cdw d1520 1435if wg7240 1435p\+mf8280cw_firmware wg7250f lbp623cdw_firmware 1435i\+_firmware 1435p d1520_firmware mf1643if_ii mf641cw_firmware lbp622cdw d1550 mf525dw mf515dw mf729cdw mf733cdw_firmware mf6180dw_firmware d1620_firmware mf820cdn_firmware mf453dw mf634cdw mf452dw_firmware mf449dw wg7250_firmware lbp215dw_firmware 1435p\+_firmware mf731cdw_firmware mf8280cw lbp214dw_firmware lbp612cdw_firmware mf741cdw lbp623cdw lbp226dw mf426dw mf745cdw mf515dw_firmware mf624cdw ir1643if_firmware 1435i\+mf1238_ii mf628cdw_firmware mf1127c_firmware mf429dw_firmware lbp1127c ir1643i_firmware d1620 mf726cdw_firmware lbp654cdw_firmware mf419dw_firmware mf424dw lbp622cdw_firmware mf414dw_firmware mf414dw mf8580cdw lbp251dw_firmware mf426dw_firmware mf820cdn mf632cdw_firmware mf1127c lbp215dw mf745cdw_firmware mf731cdw mf525dw_firmware mf416dw mf455dw mf451dw ir1643i mf746cdw_firmware mf419dw mf449dw_firmware lbp1238_ii_firmware lbp236dw mf726cdw lbp251dw mf1643if_ii_firmware lbp237dw mf1643i_ii mf628cdw mf445dw_firmware lbp664cdw_firmware d1650 mf8580cdw_firmware wg7250 mf810cdn_firmware lbp236dw_firmware wg7250f_firmware mf729cdw_firmware lbp1238_firmware 1435p_firmware mf810cdn mf543dw wg7240_firmware mf642cdw mf429dw mf452dw mf455dw_firmware 1435if_firmware lbp237dw_firmware wg7250z mf743cdw_firmware lbp253dw lbp226dw_firmware lbp664cdw lbp1238_ii ir1643if ir1435i_firmware imageCLASS MF644Cdw

CWE ID-CWE-121

Stack-based Buffer Overflow

CWE ID-CWE-787

Out-of-bounds Write

CVE-2025-14234

Matching Score-10

Assigner-Canon Inc.

View Details

Matching Score-10

Assigner-Canon Inc.

CVSS Score-9.3||CRITICAL

EPSS-0.07% / 20.14%

||

7 Day CHG~0.00%

Published-15 Jan, 2026 | 23:38

Updated-26 Feb, 2026 | 15:04

Buffer overflow in CPCA list processing on Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code. *: Satera LBP670C Series/Satera MF750C Series firmware v06.02 and earlier sold in Japan.Color imageCLASS LBP630C/Color imageCLASS MF650C Series/imageCLASS LBP230 Series/imageCLASS X LBP1238 II/imageCLASS MF450 Series/imageCLASS X MF1238 II/imageCLASS X MF1643i II/imageCLASS X MF1643iF II firmware v06.02 and earlier sold in US.i-SENSYS LBP630C Series/i-SENSYS MF650C Series/i-SENSYS LBP230 Series/1238P II/1238Pr II/i-SENSYS MF450 Series/i-SENSYS MF550 Series/1238i II/1238iF II/imageRUNNER 1643i II/imageRUNNER 1643iF II firmware v06.02 and earlier sold in Europe.

Vendor-Canon Inc.

CWE ID-CWE-787

Out-of-bounds Write

CVE-2024-0244

Matching Score-10

Assigner-Canon Inc.

View Details

Matching Score-10

Assigner-Canon Inc.

CVSS Score-9.8||CRITICAL

EPSS-0.49% / 65.66%

||

7 Day CHG~0.00%

Published-06 Feb, 2024 | 00:24

Updated-17 Jun, 2025 | 21:29

Buffer overflow in CPCA PCFAX number process of Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code.*:Satera MF750C Series firmware v03.07 and earlier sold in Japan. Color imageCLASS MF750C Series/Color imageCLASS X MF1333C firmware v03.07 and earlier sold in US. i-SENSYS MF754Cdw/C1333iF firmware v03.07 and earlier sold in Europe.

Vendor-Canon Inc.

Product-i-sensys_mf754cdw_firmware mf751cdw lbp1333c_firmware lbp1333c mf755cdw i-sensys_mf754cdw mf1333c_firmware mf751cdw_firmware i-sensys_x_c1333if mf755cdw_firmware mf753cdw mf753cdw_firmware i-sensys_x_c1333if_firmware mf1333c Color imageCLASS MF750C Series C1333iF Satera MF750C Series i-SENSYS MF754Cdw Color imageCLASS X MF1333C

CWE ID-CWE-787

Out-of-bounds Write

CVE-2023-6234

Matching Score-10

Assigner-Canon Inc.

View Details

Matching Score-10

Assigner-Canon Inc.

CVSS Score-9.8||CRITICAL

EPSS-0.49% / 65.66%

||

7 Day CHG~0.00%

Published-06 Feb, 2024 | 00:23

Updated-02 Aug, 2024 | 08:21

Buffer overflow in CPCA Color LUT Resource Download process of Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code.*: Satera LBP670C Series/Satera MF750C Series firmware v03.07 and earlier sold in Japan. Color imageCLASS LBP674C/Color imageCLASS X LBP1333C/Color imageCLASS MF750C Series/Color imageCLASS X MF1333C Series firmware v03.07 and earlier sold in US. i-SENSYS LBP673Cdw/C1333P/i-SENSYS MF750C Series/C1333i Series firmware v03.07 and earlier sold in Europe.

Vendor-Canon Inc.

Product-i-sensys_mf754cdw_firmware mf751cdw mf273dw_firmware lbp671c mf1238_ii lbp672c_firmware mf1643i_ii_firmware i-sensys_x_c1333i_firmware mf1333c lbp236dw_firmware mf275dw i-sensys_x_c1333p_firmware lbp122dw i-sensys_x_c1333i mf1643if_ii mf272dw lbp671c_firmware mf451dw_firmware lbp674cdw lbp672c i-sensys_mf754cdw mf1333c_firmware mf753cdw i-sensys_x_c1333if_firmware i-sensys_mf752cdw i-sensys_x_c1333p mf453dw mf452dw mf455dw_firmware lbp1333c_firmware lbp122dw_firmware lbp674c_firmware mf455dw mf755cdw_firmware mf452dw_firmware mf451dw lbp237dw_firmware mf753cdw_firmware lbp674cdw_firmware i-sensys_x_c1333if i-sensys_lbp673cdw_firmware i-sensys_lbp673cdw mf273dw lbp1238_ii mf275dw_firmware lbp1238_ii_firmware lbp1333c mf755cdw mf453dw_firmware mf1238_ii_firmware lbp236dw i-sensys_mf752cdw_firmware mf751cdw_firmware mf272dw_firmware lbp674c mf1643if_ii_firmware lbp237dw mf1643i_ii Color imageCLASS LBP674C Color imageCLASS MF750C Series Color imageCLASS X MF1333C Series i-SENSYS MF750C Series i-SENSYS LBP673Cdw C1333P Satera LBP670C Series Color imageCLASS X LBP1333C C1333i Series Satera MF750C Series mf750c i-sensys_lbp673cdw i-sensys_x_c1333p lbp1333c lbp674c mf1333c

CWE ID-CWE-787

Out-of-bounds Write

CVE-2023-6232

Matching Score-10

Assigner-Canon Inc.

View Details

Matching Score-10

Assigner-Canon Inc.

CVSS Score-9.8||CRITICAL

EPSS-0.36% / 58.41%

||

7 Day CHG~0.00%

Published-06 Feb, 2024 | 00:22

Updated-17 Jun, 2025 | 21:29

Buffer overflow in the Address Book username process in authentication of Mobile Device Function of Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code.*: Satera LBP670C Series/Satera MF750C Series firmware v03.07 and earlier sold in Japan. Color imageCLASS LBP674C/Color imageCLASS X LBP1333C/Color imageCLASS MF750C Series/Color imageCLASS X MF1333C Series firmware v03.07 and earlier sold in US. i-SENSYS LBP673Cdw/C1333P/i-SENSYS MF750C Series/C1333i Series firmware v03.07 and earlier sold in Europe.

Vendor-Canon Inc.

Product-i-sensys_mf754cdw_firmware mf751cdw mf273dw_firmware lbp671c mf1238_ii lbp672c_firmware mf1643i_ii_firmware i-sensys_x_c1333i_firmware mf1333c lbp236dw_firmware mf275dw i-sensys_x_c1333p_firmware lbp122dw i-sensys_x_c1333i mf1643if_ii mf272dw lbp671c_firmware mf451dw_firmware lbp674cdw lbp672c i-sensys_mf754cdw mf1333c_firmware mf753cdw i-sensys_x_c1333if_firmware i-sensys_mf752cdw i-sensys_x_c1333p mf453dw mf452dw mf455dw_firmware lbp1333c_firmware lbp122dw_firmware lbp674c_firmware mf455dw mf755cdw_firmware mf452dw_firmware mf451dw lbp237dw_firmware mf753cdw_firmware lbp674cdw_firmware i-sensys_x_c1333if i-sensys_lbp673cdw_firmware i-sensys_lbp673cdw mf273dw lbp1238_ii mf275dw_firmware lbp1238_ii_firmware lbp1333c mf755cdw mf453dw_firmware mf1238_ii_firmware lbp236dw i-sensys_mf752cdw_firmware mf751cdw_firmware mf272dw_firmware lbp674c mf1643if_ii_firmware lbp237dw mf1643i_ii Satera LBP670C Series Color imageCLASS MF750C Series C1333i Series Color imageCLASS LBP674C Color imageCLASS X MF1333C Series Satera MF750C Series i-SENSYS LBP673Cdw i-SENSYS MF750C Series Color imageCLASS X LBP1333C C1333P

CWE ID-CWE-787

Out-of-bounds Write

CVE-2020-26508

Matching Score-8

Assigner-MITRE Corporation

View Details

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-9.8||CRITICAL

EPSS-0.30% / 53.75%

||

7 Day CHG~0.00%

Published-16 Nov, 2020 | 18:49

Updated-04 Aug, 2024 | 15:56

The WebTools component on Canon Oce ColorWave 3500 5.1.1.0 devices allows attackers to retrieve stored SMB credentials via the export feature, even though these are intentionally inaccessible in the UI.

Vendor-n/a Canon Inc.

Product-oce_colorwave_3500_firmware oce_colorwave_3500 n/a

CWE ID-CWE-522

Insufficiently Protected Credentials

CVE-2025-14233

Matching Score-8

Assigner-Canon Inc.

View Details

Matching Score-8

Assigner-Canon Inc.

CVSS Score-9.3||CRITICAL

EPSS-0.10% / 26.77%

||

7 Day CHG~0.00%

Published-15 Jan, 2026 | 23:37

Updated-26 Feb, 2026 | 15:04

Invalid free in CPCA file deletion processing on Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code. *: Satera LBP670C Series/Satera MF750C Series firmware v06.02 and earlier sold in Japan.Color imageCLASS LBP630C/Color imageCLASS MF650C Series/imageCLASS LBP230 Series/imageCLASS X LBP1238 II/imageCLASS MF450 Series/imageCLASS X MF1238 II/imageCLASS X MF1643i II/imageCLASS X MF1643iF II firmware v06.02 and earlier sold in US.i-SENSYS LBP630C Series/i-SENSYS MF650C Series/i-SENSYS LBP230 Series/1238P II/1238Pr II/i-SENSYS MF450 Series/i-SENSYS MF550 Series/1238i II/1238iF II/imageRUNNER 1643i II/imageRUNNER 1643iF II firmware v06.02 and earlier sold in Europe.

Vendor-Canon Inc.

CWE ID-CWE-763

Release of Invalid Pointer or Reference

CVE-2025-0236

Matching Score-6

Assigner-Canon Inc.

View Details

Matching Score-6

Assigner-Canon Inc.

CVSS Score-5.3||MEDIUM

EPSS-0.06% / 17.47%

||

7 Day CHG~0.00%

Published-26 Feb, 2025 | 01:57

Updated-15 Apr, 2026 | 00:35

Out-of-bounds vulnerability in slope processing during curve rendering in Generic PCL6 V4 Printer Driver / Generic UFR II V4 Printer Driver / Generic LIPSLX V4 Printer Driver.

Vendor-Canon Inc.

Product-Generic UFR II V4 Printer Driver Generic PCL6 V4 Printer Driver Generic LIPSLX V4 Printer Driver

CWE ID-CWE-787

Out-of-bounds Write

CVE-2025-0234

Matching Score-6

Assigner-Canon Inc.

View Details

Matching Score-6

Assigner-Canon Inc.

CVSS Score-5.3||MEDIUM

EPSS-0.16% / 36.40%

||

7 Day CHG~0.00%

Published-26 Feb, 2025 | 01:52

Updated-15 Apr, 2026 | 00:35

Out-of-bounds vulnerability in curve segmentation processing of Generic PCL6 V4 Printer Driver / Generic UFR II V4 Printer Driver / Generic LIPSLX V4 Printer Driver.

Vendor-Canon Inc.

Product-Generic UFR II V4 Printer Driver Generic PCL6 V4 Printer Driver Generic LIPSLX V4 Printer Driver

CWE ID-CWE-787

Out-of-bounds Write

CVE-2025-9903

Matching Score-6

Assigner-Canon Inc.

View Details

Matching Score-6

Assigner-Canon Inc.

CVSS Score-5.9||MEDIUM

EPSS-0.05% / 15.03%

||

7 Day CHG-0.00%

Published-29 Sep, 2025 | 00:44

Updated-16 Mar, 2026 | 14:18

Out-of-bounds write vulnerabilities in print processing of Generic Plus PCL6 Printer Driver / Generic Plus UFR II Printer Driver / Generic Plus LIPS4 Printer Driver / Generic Plus LIPSLX Printer Driver / Generic Plus PS Printer Driver / UFRII LT Printer Driver / CARPS2 Printer Driver / Generic FAX Driver / LIPS4 Printer Driver / LIPSLX Printer Driver / UFR II Printer Driver / PS Printer Driver / PCL6 Printer Driver

Vendor-Canon Inc.

Product-PCL6 Printer Driver Generic Plus LIPSLX Printer Driver LIPSLX Printer Driver UFR II Printer Driver Generic Plus UFR II Printer Driver CARPS2 Printer Driver Generic Plus PCL6 Printer Driver Generic Plus PS Printer Driver UFRII LT Printer Driver Generic Plus LIPS4 Printer Driver PS Printer Driver Generic FAX Driver LIPS4 Printer Driver

CWE ID-CWE-787

Out-of-bounds Write

CVE-2022-24672

Matching Score-6

Assigner-Zero Day Initiative

View Details

Matching Score-6

Assigner-Zero Day Initiative

CVSS Score-8.8||HIGH

EPSS-0.18% / 38.90%

||

7 Day CHG~0.00%

Published-28 Mar, 2023 | 00:00

Updated-19 Feb, 2025 | 15:41

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Canon imageCLASS MF644Cdw 10.02 printers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the CADM service. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-15802.

Vendor-Canon Inc.

Product-mf741cdw_firmware mf735cdw_firmware d1550_firmware mf6180dw mf641cw mf424dw_firmware mf1643i_ii_firmware mf1238_firmware lbp228dw_firmware mf543dw_firmware mf634cdw_firmware mf1238 mf451dw_firmware mf624cdw_firmware mf733cdw mf743cdw mf735cdw lbp612cdw mf746cdw 1435if\+mf448dw mf448dw_firmware mf6160dw_firmware mf644cdw_firmware lbp1127c_firmware d1650_firmware wg7250z_firmware mf632cdw 1435if\+_firmware lbp228dw lbp253dw_firmware mf445dw lbp227dw mf6160dw mf642cdw_firmware lbp1238 lbp654cdw mf416dw_firmware mf453dw_firmware mf1238_ii_firmware lbp214dw lbp227dw_firmware ir1435i mf644cdw d1520 1435if wg7240 1435p\+mf8280cw_firmware wg7250f lbp623cdw_firmware 1435i\+_firmware 1435p d1520_firmware mf1643if_ii mf641cw_firmware lbp622cdw d1550 mf525dw mf515dw mf729cdw mf733cdw_firmware mf6180dw_firmware d1620_firmware mf820cdn_firmware mf453dw mf634cdw mf452dw_firmware mf449dw wg7250_firmware lbp215dw_firmware 1435p\+_firmware mf731cdw_firmware mf8280cw lbp214dw_firmware lbp612cdw_firmware mf741cdw lbp623cdw lbp226dw mf426dw mf745cdw mf515dw_firmware mf624cdw ir1643if_firmware 1435i\+mf1238_ii mf628cdw_firmware mf1127c_firmware mf429dw_firmware lbp1127c ir1643i_firmware d1620 mf726cdw_firmware lbp654cdw_firmware mf419dw_firmware mf424dw lbp622cdw_firmware mf414dw_firmware mf414dw mf8580cdw lbp251dw_firmware mf426dw_firmware mf820cdn mf632cdw_firmware mf1127c lbp215dw mf745cdw_firmware mf731cdw mf525dw_firmware mf416dw mf455dw mf451dw ir1643i mf746cdw_firmware mf419dw mf449dw_firmware lbp1238_ii_firmware lbp236dw mf726cdw lbp251dw mf1643if_ii_firmware lbp237dw mf1643i_ii mf628cdw mf445dw_firmware lbp664cdw_firmware d1650 mf8580cdw_firmware wg7250 mf810cdn_firmware lbp236dw_firmware wg7250f_firmware mf729cdw_firmware lbp1238_firmware 1435p_firmware mf810cdn mf543dw wg7240_firmware mf642cdw mf429dw mf452dw mf455dw_firmware 1435if_firmware lbp237dw_firmware wg7250z mf743cdw_firmware lbp253dw lbp226dw_firmware lbp664cdw lbp1238_ii ir1643if ir1435i_firmware imageCLASS MF644Cdw

CWE ID-CWE-122

Heap-based Buffer Overflow

CWE ID-CWE-787

Out-of-bounds Write

CVE-2022-24674

Matching Score-6

Assigner-Zero Day Initiative

View Details

Matching Score-6

Assigner-Zero Day Initiative

CVSS Score-8.8||HIGH

EPSS-0.11% / 28.79%

||

7 Day CHG~0.00%

Published-28 Mar, 2023 | 00:00

Updated-19 Feb, 2025 | 15:37

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Canon imageCLASS MF644Cdw 10.02 printers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the privet API. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-15834.

Vendor-Canon Inc.

Product-mf741cdw_firmware mf735cdw_firmware d1550_firmware mf6180dw mf641cw mf424dw_firmware mf1643i_ii_firmware mf1238_firmware lbp228dw_firmware mf543dw_firmware mf634cdw_firmware mf1238 mf451dw_firmware mf624cdw_firmware mf733cdw mf743cdw mf735cdw lbp612cdw mf746cdw 1435if\+mf448dw mf448dw_firmware mf6160dw_firmware mf644cdw_firmware lbp1127c_firmware d1650_firmware wg7250z_firmware mf632cdw 1435if\+_firmware lbp228dw lbp253dw_firmware mf445dw lbp227dw mf6160dw mf642cdw_firmware lbp1238 lbp654cdw mf416dw_firmware mf453dw_firmware mf1238_ii_firmware lbp214dw lbp227dw_firmware ir1435i mf644cdw d1520 1435if wg7240 1435p\+mf8280cw_firmware wg7250f lbp623cdw_firmware 1435i\+_firmware 1435p d1520_firmware mf1643if_ii mf641cw_firmware lbp622cdw d1550 mf525dw mf515dw mf729cdw mf733cdw_firmware mf6180dw_firmware d1620_firmware mf820cdn_firmware mf453dw mf634cdw mf452dw_firmware mf449dw wg7250_firmware lbp215dw_firmware 1435p\+_firmware mf731cdw_firmware mf8280cw lbp214dw_firmware lbp612cdw_firmware mf741cdw lbp623cdw lbp226dw mf426dw mf745cdw mf515dw_firmware mf624cdw ir1643if_firmware 1435i\+mf1238_ii mf628cdw_firmware mf1127c_firmware mf429dw_firmware lbp1127c ir1643i_firmware d1620 mf726cdw_firmware lbp654cdw_firmware mf419dw_firmware mf424dw lbp622cdw_firmware mf414dw_firmware mf414dw mf8580cdw lbp251dw_firmware mf426dw_firmware mf820cdn mf632cdw_firmware mf1127c lbp215dw mf745cdw_firmware mf731cdw mf525dw_firmware mf416dw mf455dw mf451dw ir1643i mf746cdw_firmware mf419dw mf449dw_firmware lbp1238_ii_firmware lbp236dw mf726cdw lbp251dw mf1643if_ii_firmware lbp237dw mf1643i_ii mf628cdw mf445dw_firmware lbp664cdw_firmware d1650 mf8580cdw_firmware wg7250 mf810cdn_firmware lbp236dw_firmware wg7250f_firmware mf729cdw_firmware lbp1238_firmware 1435p_firmware mf810cdn mf543dw wg7240_firmware mf642cdw mf429dw mf452dw mf455dw_firmware 1435if_firmware lbp237dw_firmware wg7250z mf743cdw_firmware lbp253dw lbp226dw_firmware lbp664cdw lbp1238_ii ir1643if ir1435i_firmware imageCLASS MF644Cdw

CWE ID-CWE-121

Stack-based Buffer Overflow

CWE ID-CWE-787

Out-of-bounds Write

CVE-2025-1268

Matching Score-6

Assigner-Canon Inc.

View Details

Matching Score-6

Assigner-Canon Inc.

CVSS Score-9.4||CRITICAL

EPSS-0.44% / 63.30%

||

7 Day CHG~0.00%

Published-31 Mar, 2025 | 00:52

Updated-15 Apr, 2026 | 00:35

Out-of-bounds vulnerability in EMF Recode processing of Generic Plus PCL6 Printer Driver / Generic Plus UFR II Printer Driver / Generic Plus LIPS4 Printer Driver / Generic Plus LIPSLX Printer Driver / Generic Plus PS Printer Driver / Generic FAX Printer Driver / UFRII LT Printer Driver / CARPS2 Printer Driver / PDF Driver / LIPS4 Printer Driver / LIPSLX Printer Driver / UFR II Printer Driver / PS Printer Driver / PCL6 Printer Driver

Vendor-Canon Inc.

Product-PCL6 Printer Driver Generic Plus LIPSLX Printer Driver PDF Driver LIPSLX Printer Driver UFR II Printer Driver Generic Plus UFR II Printer Driver CARPS2 Printer Driver Generic Plus PCL6 Printer Driver Generic Plus PS Printer Driver Generic FAX Printer Driver UFRII LT Printer Driver Generic Plus LIPS4 Printer Driver PS Printer Driver LIPS4 Printer Driver

CWE ID-CWE-787

Out-of-bounds Write

CVE-2025-0235

Matching Score-6

Assigner-Canon Inc.

View Details

Matching Score-6

Assigner-Canon Inc.

CVSS Score-5.3||MEDIUM

EPSS-0.07% / 22.29%

||

7 Day CHG~0.00%

Published-26 Feb, 2025 | 01:56

Updated-15 Apr, 2026 | 00:35

Out-of-bounds vulnerability due to improper memory release during image rendering in Generic PCL6 V4 Printer Driver / Generic UFR II V4 Printer Driver / Generic LIPSLX V4 Printer Driver.

Vendor-Canon Inc.

Product-Generic UFR II V4 Printer Driver Generic PCL6 V4 Printer Driver Generic LIPSLX V4 Printer Driver

CWE ID-CWE-787

Out-of-bounds Write

CVE-2019-5999

Matching Score-6

Assigner-JPCERT/CC

View Details

Matching Score-6

Assigner-JPCERT/CC

CVSS Score-8.8||HIGH

EPSS-0.33% / 55.50%

||

7 Day CHG~0.00%

Published-06 Aug, 2019 | 18:41

Updated-04 Aug, 2024 | 20:09

Buffer overflow in PTP (Picture Transfer Protocol) of EOS series digital cameras (EOS-1D X firmware version 2.1.0 and earlier, EOS-1D X MKII firmware version 1.1.6 and earlier, EOS-1D C firmware version 1.4.1 and earlier, EOS 5D MARK III firmware version 1.3.5 and earlier, EOS 5D MARK IV firmware version 1.2.0 and earlier, EOS 5DS firmware version 1.1.2 and earlier, EOS 5DS R firmware version 1.1.2 and earlier, EOS 6D firmware version 1.1.8 and earlier, EOS 6D MARK II firmware version 1.0.4 and earlier, EOS 7D MARK II firmware version 1.1.2 and earlier, EOS 70 D firmware version 1.1.2 and earlier, EOS 80 D firmware version 1.0.2 and earlier, EOS KISS X7I / EOS D REBEL T5I / EOS 700D firmware version 1.1.5 and earlier, EOS KISS X8I / EOS D REBEL T6I / EOS 750D firmware version 1.0.0 and earlier, EOS KISS X9I / EOS D REBEL T7I / EOS 800D firmware version 1.0.1 and earlier, EOS KISS X7 / EOS D REBEL SL1 / EOS 100D firmware version 1.0.1 and earlier, EOS KISS X9 / EOS D REBEL SL2 / EOS 200D firmware version 1.0.1 and earlier, EOS KISS X10 / EOS D REBEL SL3 / EOS 200D / EOS 250D firmware version 1.0.1 and earlier, EOS 8000D / EOS D REBEL T6S / EOS 760D firmware version 1.0.0 and earlier, EOS 9000D / EOS 77D firmware version 1.0.2 and earlier, EOS KISS X70 / EOS D REBEL T5 / EOS 1200D firmware version 1.0.2 and earlier, EOS D REBEL T5 RE / EOS 1200D MG / EOS HI firmware version 1.0.2 and earlier, EOS KISS X80 / EOS D REBEL T6 / EOS 1300D firmware version 1.1.0 and earlier, EOS KISS X90 / EOS D REBEL T7 / EOS 1500D / EOS 2000D firmware version 1.0.0 and earlier, EOS D REBEL T100 / EOS 3000D / EOS 4000D firmware version 1.0.0 and earlier, EOS R firmware version 1.3.0 and earlier, EOS RP firmware version 1.2.0 and earlier, EOS RP GOLD firmware version 1.2.0 and earlier, EOS M2 firmware version 1.0.3 and earlier, EOS M3 firmware version 1.2.0 and earlier, EOS M5 firmware version 1.0.1 and earlier, EOS M6 firmware version 1.0.1 and earlier, EOS M6(China) firmware version 5.0.0 and earlier, EOS M10 firmware version 1.1.0 and earlier, EOS M100 firmware version 1.0.0 and earlier, EOS KISS M / EOS M50 firmware version 1.0.2 and earlier) and PowerShot SX740 HS firmware version 1.0.1 and earlier, PowerShot SX70 HS firmware version 1.1.0 and earlier, and PowerShot G5Xmark II firmware version 1.0.1 and earlier allows an attacker on the same network segment to trigger the affected product being unresponsive or to execute arbitrary code on the affected product via blerequest command.

Vendor-Canon Inc.

CWE ID-CWE-787

Out-of-bounds Write

CVE-2019-6000

Matching Score-6

Assigner-JPCERT/CC

View Details

Matching Score-6

Assigner-JPCERT/CC

CVSS Score-8.8||HIGH

EPSS-0.33% / 55.50%

||

7 Day CHG~0.00%

Published-06 Aug, 2019 | 18:41

Updated-04 Aug, 2024 | 20:09

Buffer overflow in PTP (Picture Transfer Protocol) of EOS series digital cameras (EOS-1D X firmware version 2.1.0 and earlier, EOS-1D X MKII firmware version 1.1.6 and earlier, EOS-1D C firmware version 1.4.1 and earlier, EOS 5D MARK III firmware version 1.3.5 and earlier, EOS 5D MARK IV firmware version 1.2.0 and earlier, EOS 5DS firmware version 1.1.2 and earlier, EOS 5DS R firmware version 1.1.2 and earlier, EOS 6D firmware version 1.1.8 and earlier, EOS 6D MARK II firmware version 1.0.4 and earlier, EOS 7D MARK II firmware version 1.1.2 and earlier, EOS 70 D firmware version 1.1.2 and earlier, EOS 80 D firmware version 1.0.2 and earlier, EOS KISS X7I / EOS D REBEL T5I / EOS 700D firmware version 1.1.5 and earlier, EOS KISS X8I / EOS D REBEL T6I / EOS 750D firmware version 1.0.0 and earlier, EOS KISS X9I / EOS D REBEL T7I / EOS 800D firmware version 1.0.1 and earlier, EOS KISS X7 / EOS D REBEL SL1 / EOS 100D firmware version 1.0.1 and earlier, EOS KISS X9 / EOS D REBEL SL2 / EOS 200D firmware version 1.0.1 and earlier, EOS KISS X10 / EOS D REBEL SL3 / EOS 200D / EOS 250D firmware version 1.0.1 and earlier, EOS 8000D / EOS D REBEL T6S / EOS 760D firmware version 1.0.0 and earlier, EOS 9000D / EOS 77D firmware version 1.0.2 and earlier, EOS KISS X70 / EOS D REBEL T5 / EOS 1200D firmware version 1.0.2 and earlier, EOS D REBEL T5 RE / EOS 1200D MG / EOS HI firmware version 1.0.2 and earlier, EOS KISS X80 / EOS D REBEL T6 / EOS 1300D firmware version 1.1.0 and earlier, EOS KISS X90 / EOS D REBEL T7 / EOS 1500D / EOS 2000D firmware version 1.0.0 and earlier, EOS D REBEL T100 / EOS 3000D / EOS 4000D firmware version 1.0.0 and earlier, EOS R firmware version 1.3.0 and earlier, EOS RP firmware version 1.2.0 and earlier, EOS RP GOLD firmware version 1.2.0 and earlier, EOS M2 firmware version 1.0.3 and earlier, EOS M3 firmware version 1.2.0 and earlier, EOS M5 firmware version 1.0.1 and earlier, EOS M6 firmware version 1.0.1 and earlier, EOS M6(China) firmware version 5.0.0 and earlier, EOS M10 firmware version 1.1.0 and earlier, EOS M100 firmware version 1.0.0 and earlier, EOS KISS M / EOS M50 firmware version 1.0.2 and earlier) and PowerShot SX740 HS firmware version 1.0.1 and earlier, PowerShot SX70 HS firmware version 1.1.0 and earlier, and PowerShot G5Xmark II firmware version 1.0.1 and earlier allows an attacker on the same network segment to trigger the affected product being unresponsive or to execute arbitrary code on the affected product via sendhostinfo command.

Vendor-Canon Inc.

CWE ID-CWE-787

Out-of-bounds Write

CVE-2019-5998

Matching Score-6

Assigner-JPCERT/CC

View Details

Matching Score-6

Assigner-JPCERT/CC

CVSS Score-8.8||HIGH

EPSS-0.55% / 68.08%

||

7 Day CHG~0.00%

Published-06 Aug, 2019 | 18:41

Updated-04 Aug, 2024 | 20:09

Buffer overflow in PTP (Picture Transfer Protocol) of EOS series digital cameras (EOS-1D X firmware version 2.1.0 and earlier, EOS-1D X MKII firmware version 1.1.6 and earlier, EOS-1D C firmware version 1.4.1 and earlier, EOS 5D MARK III firmware version 1.3.5 and earlier, EOS 5D MARK IV firmware version 1.2.0 and earlier, EOS 5DS firmware version 1.1.2 and earlier, EOS 5DS R firmware version 1.1.2 and earlier, EOS 6D firmware version 1.1.8 and earlier, EOS 6D MARK II firmware version 1.0.4 and earlier, EOS 7D MARK II firmware version 1.1.2 and earlier, EOS 70 D firmware version 1.1.2 and earlier, EOS 80 D firmware version 1.0.2 and earlier, EOS KISS X7I / EOS D REBEL T5I / EOS 700D firmware version 1.1.5 and earlier, EOS KISS X8I / EOS D REBEL T6I / EOS 750D firmware version 1.0.0 and earlier, EOS KISS X9I / EOS D REBEL T7I / EOS 800D firmware version 1.0.1 and earlier, EOS KISS X7 / EOS D REBEL SL1 / EOS 100D firmware version 1.0.1 and earlier, EOS KISS X9 / EOS D REBEL SL2 / EOS 200D firmware version 1.0.1 and earlier, EOS KISS X10 / EOS D REBEL SL3 / EOS 200D / EOS 250D firmware version 1.0.1 and earlier, EOS 8000D / EOS D REBEL T6S / EOS 760D firmware version 1.0.0 and earlier, EOS 9000D / EOS 77D firmware version 1.0.2 and earlier, EOS KISS X70 / EOS D REBEL T5 / EOS 1200D firmware version 1.0.2 and earlier, EOS D REBEL T5 RE / EOS 1200D MG / EOS HI firmware version 1.0.2 and earlier, EOS KISS X80 / EOS D REBEL T6 / EOS 1300D firmware version 1.1.0 and earlier, EOS KISS X90 / EOS D REBEL T7 / EOS 1500D / EOS 2000D firmware version 1.0.0 and earlier, EOS D REBEL T100 / EOS 3000D / EOS 4000D firmware version 1.0.0 and earlier, EOS R firmware version 1.3.0 and earlier, EOS RP firmware version 1.2.0 and earlier, EOS RP GOLD firmware version 1.2.0 and earlier, EOS M2 firmware version 1.0.3 and earlier, EOS M3 firmware version 1.2.0 and earlier, EOS M5 firmware version 1.0.1 and earlier, EOS M6 firmware version 1.0.1 and earlier, EOS M6(China) firmware version 5.0.0 and earlier, EOS M10 firmware version 1.1.0 and earlier, EOS M100 firmware version 1.0.0 and earlier, EOS KISS M / EOS M50 firmware version 1.0.2 and earlier) and PowerShot SX740 HS firmware version 1.0.1 and earlier, PowerShot SX70 HS firmware version 1.1.0 and earlier, and PowerShot G5Xmark II firmware version 1.0.1 and earlier allows an attacker on the same network segment to trigger the affected product being unresponsive or to execute arbitrary code on the affected product via notifybtstatus command.

Vendor-Canon Inc.

CWE ID-CWE-787

Out-of-bounds Write

CVE-2021-41736

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-9.8||CRITICAL

EPSS-0.39% / 59.85%

||

7 Day CHG~0.00%

Published-22 Mar, 2022 | 17:23

Updated-04 Aug, 2024 | 03:15

Faust v2.35.0 was discovered to contain a heap-buffer overflow in the function realPropagate() at propagate.cpp.

Vendor-grame n/a

Product-faust n/a

CWE ID-CWE-787

Out-of-bounds Write

CVE-2015-5628

Matching Score-4

Assigner-JPCERT/CC

View Details

Matching Score-4

Assigner-JPCERT/CC

CVSS Score-9.8||CRITICAL

EPSS-7.49% / 91.83%

||

7 Day CHG~0.00%

Published-05 Feb, 2020 | 18:46

Updated-06 Aug, 2024 | 06:59

Stack-based buffer overflow in Yokogawa CENTUM CS 1000 R3.08.70 and earlier, CENTUM CS 3000 R3.09.50 and earlier, CENTUM CS 3000 Entry R3.09.50 and earlier, CENTUM VP R5.04.20 and earlier, CENTUM VP Entry R5.04.20 and earlier, ProSafe-RS R3.02.10 and earlier, Exaopc R3.72.00 and earlier, Exaquantum R2.85.00 and earlier, Exaquantum/Batch R2.50.30 and earlier, Exapilot R3.96.10 and earlier, Exaplog R3.40.00 and earlier, Exasmoc R4.03.20 and earlier, Exarqe R4.03.20 and earlier, Field Wireless Device OPC Server R2.01.02 and earlier, PRM R3.12.00 and earlier, STARDOM VDS R7.30.01 and earlier, STARDOM OPC Server for Windows R3.40 and earlier, FAST/TOOLS R10.01 and earlier, B/M9000CS R5.05.01 and earlier, B/M9000 VP R7.03.04 and earlier, and FieldMate R1.01 or R1.02 allows remote attackers to execute arbitrary code via a crafted packet.

Vendor-yokogawa Yokogawa

CWE ID-CWE-787

Out-of-bounds Write

CVE-2025-12603

Matching Score-4

Assigner-a0340c66-c385-4f8b-991b-3d05f6fd5220

View Details

Matching Score-4

Assigner-a0340c66-c385-4f8b-991b-3d05f6fd5220

CVSS Score-2.3||LOW

EPSS-0.05% / 14.80%

||

7 Day CHG~0.00%

Published-01 Nov, 2025 | 18:56

Updated-07 Nov, 2025 | 18:40

/etc/timezone can be Arbitrarily Written

/etc/timezone can be Arbitrarily Written.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.

Vendor-azure-access Azure Access Technology

Product-blu-ic2 blu-ic4_firmware blu-ic2_firmware blu-ic4 BLU-IC2 BLU-IC4

CWE ID-CWE-787

Out-of-bounds Write

CVE-2021-42018

Matching Score-4

Assigner-Siemens

View Details

Matching Score-4

Assigner-Siemens

CVSS Score-5.9||MEDIUM

EPSS-0.33% / 55.60%

||

7 Day CHG~0.00%

Published-08 Mar, 2022 | 11:31

Updated-12 Aug, 2025 | 12:15

A vulnerability has been identified in RUGGEDCOM i800, RUGGEDCOM i800NC, RUGGEDCOM i801, RUGGEDCOM i801NC, RUGGEDCOM i802, RUGGEDCOM i802NC, RUGGEDCOM i803, RUGGEDCOM i803NC, RUGGEDCOM M2100, RUGGEDCOM M2100F, RUGGEDCOM M2100NC, RUGGEDCOM M2200, RUGGEDCOM M2200F, RUGGEDCOM M2200NC, RUGGEDCOM M969, RUGGEDCOM M969F, RUGGEDCOM M969NC, RUGGEDCOM RMC30, RUGGEDCOM RMC30NC, RUGGEDCOM RMC8388 V4.X, RUGGEDCOM RMC8388 V5.X, RUGGEDCOM RMC8388NC V4.X, RUGGEDCOM RMC8388NC V5.X, RUGGEDCOM RP110, RUGGEDCOM RP110NC, RUGGEDCOM RS1600, RUGGEDCOM RS1600F, RUGGEDCOM RS1600FNC, RUGGEDCOM RS1600NC, RUGGEDCOM RS1600T, RUGGEDCOM RS1600TNC, RUGGEDCOM RS400, RUGGEDCOM RS400F, RUGGEDCOM RS400NC, RUGGEDCOM RS401, RUGGEDCOM RS401NC, RUGGEDCOM RS416, RUGGEDCOM RS416F, RUGGEDCOM RS416NC, RUGGEDCOM RS416NCv2 V4.X, RUGGEDCOM RS416NCv2 V5.X, RUGGEDCOM RS416P, RUGGEDCOM RS416PF, RUGGEDCOM RS416PNC, RUGGEDCOM RS416PNCv2 V4.X, RUGGEDCOM RS416PNCv2 V5.X, RUGGEDCOM RS416Pv2 V4.X, RUGGEDCOM RS416Pv2 V5.X, RUGGEDCOM RS416v2 V4.X, RUGGEDCOM RS416v2 V5.X, RUGGEDCOM RS8000, RUGGEDCOM RS8000A, RUGGEDCOM RS8000ANC, RUGGEDCOM RS8000H, RUGGEDCOM RS8000HNC, RUGGEDCOM RS8000NC, RUGGEDCOM RS8000T, RUGGEDCOM RS8000TNC, RUGGEDCOM RS900, RUGGEDCOM RS900 (32M) V4.X, RUGGEDCOM RS900 (32M) V5.X, RUGGEDCOM RS900F, RUGGEDCOM RS900G, RUGGEDCOM RS900G (32M) V4.X, RUGGEDCOM RS900G (32M) V5.X, RUGGEDCOM RS900GF, RUGGEDCOM RS900GNC, RUGGEDCOM RS900GNC(32M) V4.X, RUGGEDCOM RS900GNC(32M) V5.X, RUGGEDCOM RS900GP, RUGGEDCOM RS900GPF, RUGGEDCOM RS900GPNC, RUGGEDCOM RS900L, RUGGEDCOM RS900LNC, RUGGEDCOM RS900M-GETS-C01, RUGGEDCOM RS900M-GETS-XX, RUGGEDCOM RS900M-STND-C01, RUGGEDCOM RS900M-STND-XX, RUGGEDCOM RS900MNC-GETS-C01, RUGGEDCOM RS900MNC-GETS-XX, RUGGEDCOM RS900MNC-STND-XX, RUGGEDCOM RS900MNC-STND-XX-C01, RUGGEDCOM RS900NC, RUGGEDCOM RS900NC(32M) V4.X, RUGGEDCOM RS900NC(32M) V5.X, RUGGEDCOM RS900W, RUGGEDCOM RS910, RUGGEDCOM RS910L, RUGGEDCOM RS910LNC, RUGGEDCOM RS910NC, RUGGEDCOM RS910W, RUGGEDCOM RS920L, RUGGEDCOM RS920LNC, RUGGEDCOM RS920W, RUGGEDCOM RS930L, RUGGEDCOM RS930LNC, RUGGEDCOM RS930W, RUGGEDCOM RS940G, RUGGEDCOM RS940GF, RUGGEDCOM RS940GNC, RUGGEDCOM RS969, RUGGEDCOM RS969NC, RUGGEDCOM RSG2100, RUGGEDCOM RSG2100 (32M) V4.X, RUGGEDCOM RSG2100 (32M) V5.X, RUGGEDCOM RSG2100F, RUGGEDCOM RSG2100NC, RUGGEDCOM RSG2100NC(32M) V4.X, RUGGEDCOM RSG2100NC(32M) V5.X, RUGGEDCOM RSG2100P, RUGGEDCOM RSG2100P (32M) V4.X, RUGGEDCOM RSG2100P (32M) V5.X, RUGGEDCOM RSG2100PF, RUGGEDCOM RSG2100PNC, RUGGEDCOM RSG2100PNC (32M) V4.X, RUGGEDCOM RSG2100PNC (32M) V5.X, RUGGEDCOM RSG2200, RUGGEDCOM RSG2200F, RUGGEDCOM RSG2200NC, RUGGEDCOM RSG2288 V4.X, RUGGEDCOM RSG2288 V5.X, RUGGEDCOM RSG2288NC V4.X, RUGGEDCOM RSG2288NC V5.X, RUGGEDCOM RSG2300 V4.X, RUGGEDCOM RSG2300 V5.X, RUGGEDCOM RSG2300F, RUGGEDCOM RSG2300NC V4.X, RUGGEDCOM RSG2300NC V5.X, RUGGEDCOM RSG2300P V4.X, RUGGEDCOM RSG2300P V5.X, RUGGEDCOM RSG2300PF, RUGGEDCOM RSG2300PNC V4.X, RUGGEDCOM RSG2300PNC V5.X, RUGGEDCOM RSG2488 V4.X, RUGGEDCOM RSG2488 V5.X, RUGGEDCOM RSG2488F, RUGGEDCOM RSG2488NC V4.X, RUGGEDCOM RSG2488NC V5.X, RUGGEDCOM RSG907R, RUGGEDCOM RSG908C, RUGGEDCOM RSG909R, RUGGEDCOM RSG910C, RUGGEDCOM RSG920P V4.X, RUGGEDCOM RSG920P V5.X, RUGGEDCOM RSG920PNC V4.X, RUGGEDCOM RSG920PNC V5.X, RUGGEDCOM RSL910, RUGGEDCOM RSL910NC, RUGGEDCOM RST2228, RUGGEDCOM RST2228P, RUGGEDCOM RST916C, RUGGEDCOM RST916P. Within a third-party component, whenever memory allocation is requested, the out of bound size is not checked. Therefore, if size exceeding the expected allocation is assigned, it could allocate a smaller buffer instead. If an attacker were to exploit this, they could cause a heap overflow.

Vendor-Siemens AG

Product-ruggedcom_rs969 ruggedcom_rs910 ruggedcom_rsg2100 ruggedcom_rsg2300p ruggedcom_rs930l ruggedcom_rsg907r ruggedcom_rsg910c ruggedcom_rs416 ruggedcom_rs900w ruggedcom_i801 ruggedcom_ros ruggedcom_m2100 ruggedcom_rmc ruggedcom_i800 ruggedcom_rst2228 ruggedcom_rs930w ruggedcom_rmc8388 ruggedcom_rsg2200 ruggedcom_rs900 ruggedcom_rs401 ruggedcom_rs8000t ruggedcom_rsg909r ruggedcom_rp110 ruggedcom_rs910l ruggedcom_i802 ruggedcom_m969 ruggedcom_rs910w ruggedcom_rsg2100p ruggedcom_rs8000 ruggedcom_rst916p ruggedcom_rs900gp ruggedcom_rs900l ruggedcom_rmc40 ruggedcom_rsl910 ruggedcom_rmc41 ruggedcom_rsg920p ruggedcom_rs920w ruggedcom_rs416v2 ruggedcom_rs8000a ruggedcom_rsg2300 ruggedcom_rst916c ruggedcom_m2200 ruggedcom_rs400 ruggedcom_rst2228p ruggedcom_rmc20 ruggedcom_rs8000h ruggedcom_rsg908c ruggedcom_i803 ruggedcom_rsg2488 ruggedcom_rs900g ruggedcom_rsg2288 ruggedcom_rs920l ruggedcom_rs940g ruggedcom_rmc30 RUGGEDCOM RS8000 RUGGEDCOM RS900L RUGGEDCOM RSG2300 V4.X RUGGEDCOM RS900MNC-STND-XX-C01 RUGGEDCOM RSG920P V4.X RUGGEDCOM RS401NC RUGGEDCOM RSG2100PNC (32M) V4.X RUGGEDCOM RS920LNC RUGGEDCOM RS910L RUGGEDCOM RS930W RUGGEDCOM RSG2100NC(32M) V5.X RUGGEDCOM RSG2100 (32M) V5.X RUGGEDCOM RSG2288NC V5.X RUGGEDCOM RS416Pv2 V4.X RUGGEDCOM RS1600 RUGGEDCOM i801NC RUGGEDCOM RS940G RUGGEDCOM RSG2100NC(32M) V4.X RUGGEDCOM i800NC RUGGEDCOM RS910 RUGGEDCOM RSG908C RUGGEDCOM RS8000NC RUGGEDCOM RS400F RUGGEDCOM RS900NC(32M) V4.X RUGGEDCOM RS920L RUGGEDCOM RMC8388 V4.X RUGGEDCOM RS8000H RUGGEDCOM RS900LNC RUGGEDCOM RS8000T RUGGEDCOM RS910NC RUGGEDCOM RS416PF RUGGEDCOM RS900G RUGGEDCOM M2100F RUGGEDCOM RS900M-STND-XX RUGGEDCOM RS900W RUGGEDCOM RMC8388 V5.X RUGGEDCOM RS900MNC-STND-XX RUGGEDCOM RSG2100PNC (32M) V5.X RUGGEDCOM RSG910C RUGGEDCOM RSG2300PF RUGGEDCOM RSG2288 V4.X RUGGEDCOM RS1600NC RUGGEDCOM RS969 RUGGEDCOM RS900 (32M) V4.X RUGGEDCOM RSG909R RUGGEDCOM RS416F RUGGEDCOM RS900GPF RUGGEDCOM RSG2100P RUGGEDCOM RS930LNC RUGGEDCOM RS416P RUGGEDCOM RSG920P V5.X RUGGEDCOM RSG2200NC RUGGEDCOM RS8000HNC RUGGEDCOM RSG2300PNC V5.X RUGGEDCOM RSG2288 V5.X RUGGEDCOM RS1600F RUGGEDCOM RS416NC RUGGEDCOM RS930L RUGGEDCOM RSG907R RUGGEDCOM RSG2300P V5.X RUGGEDCOM RS910W RUGGEDCOM RSG2300 V5.X RUGGEDCOM RS940GNC RUGGEDCOM RS900GNC RUGGEDCOM RSG2100P (32M) V4.X RUGGEDCOM RMC8388NC V5.X RUGGEDCOM RS940GF RUGGEDCOM RS910LNC RUGGEDCOM RSG2288NC V4.X RUGGEDCOM RSG2488 V5.X RUGGEDCOM RMC30 RUGGEDCOM RS900GF RUGGEDCOM RS8000ANC RUGGEDCOM RMC8388NC V4.X RUGGEDCOM RS1600T RUGGEDCOM M969F RUGGEDCOM RS900G (32M) V5.X RUGGEDCOM RS400NC RUGGEDCOM RS900MNC-GETS-C01 RUGGEDCOM RS900M-GETS-C01 RUGGEDCOM RSG2488NC V4.X RUGGEDCOM M2200F RUGGEDCOM RP110 RUGGEDCOM i801 RUGGEDCOM RS416v2 V4.X RUGGEDCOM RS416NCv2 V4.X RUGGEDCOM RS8000TNC RUGGEDCOM RSG2300P V4.X RUGGEDCOM RS416v2 V5.X RUGGEDCOM RS920W RUGGEDCOM RS900F RUGGEDCOM M2200 RUGGEDCOM RS900MNC-GETS-XX RUGGEDCOM RSG2300NC V5.X RUGGEDCOM RS900GNC(32M) V4.X RUGGEDCOM RS900 RUGGEDCOM RSG2100 RUGGEDCOM M969NC RUGGEDCOM RS416PNC RUGGEDCOM RS1600FNC RUGGEDCOM RS400 RUGGEDCOM RS900NC(32M) V5.X RUGGEDCOM RS1600TNC RUGGEDCOM RS900G (32M) V4.X RUGGEDCOM M969 RUGGEDCOM RS416PNCv2 V4.X RUGGEDCOM M2200NC RUGGEDCOM RS8000A RUGGEDCOM i803 RUGGEDCOM RSG2100PNC RUGGEDCOM RSG920PNC V5.X RUGGEDCOM RSG2100NC RUGGEDCOM RSG2488F RUGGEDCOM RP110NC RUGGEDCOM RSG2200 RUGGEDCOM RSG2488NC V5.X RUGGEDCOM RSL910NC RUGGEDCOM RS969NC RUGGEDCOM RS416 RUGGEDCOM RST2228P RUGGEDCOM i800 RUGGEDCOM RS900M-STND-C01 RUGGEDCOM RS900M-GETS-XX RUGGEDCOM RST916P RUGGEDCOM RS416PNCv2 V5.X RUGGEDCOM RS416NCv2 V5.X RUGGEDCOM RSG2100 (32M) V4.X RUGGEDCOM RSL910 RUGGEDCOM RSG2100PF RUGGEDCOM RS900GP RUGGEDCOM RST916C RUGGEDCOM RS900GPNC RUGGEDCOM RSG2100F RUGGEDCOM RSG2488 V4.X RUGGEDCOM i802 RUGGEDCOM RS900GNC(32M) V5.X RUGGEDCOM RST2228 RUGGEDCOM RS401 RUGGEDCOM RSG2300NC V4.X RUGGEDCOM RSG920PNC V4.X RUGGEDCOM i802NC RUGGEDCOM i803NC RUGGEDCOM M2100 RUGGEDCOM RSG2300F RUGGEDCOM RSG2300PNC V4.X RUGGEDCOM RS900NC RUGGEDCOM RS416Pv2 V5.X RUGGEDCOM RMC30NC RUGGEDCOM RS900 (32M) V5.X RUGGEDCOM RSG2200F RUGGEDCOM M2100NC RUGGEDCOM RSG2100P (32M) V5.X

CWE ID-CWE-122

Heap-based Buffer Overflow

CWE ID-CWE-787

Out-of-bounds Write

CVE-2017-20227

Matching Score-4

Assigner-VulnCheck

View Details

Matching Score-4

Assigner-VulnCheck

CVSS Score-9.3||CRITICAL

EPSS-0.08% / 23.43%

||

7 Day CHG~0.00%

Published-28 Mar, 2026 | 11:58

Updated-08 Apr, 2026 | 19:37

JAD 1.5.8e-1kali1 Stack-Based Buffer Overflow

JAD Java Decompiler 1.5.8e-1kali1 and prior contains a stack-based buffer overflow vulnerability that allows attackers to execute arbitrary code by supplying overly long input that exceeds buffer boundaries. Attackers can craft malicious input passed to the jad command to overflow the stack and execute a return-oriented programming chain that spawns a shell.

Vendor-varaneckas Varaneckas

Product-jad_java_decompiler JAD Java Decompiler

CWE ID-CWE-787

Out-of-bounds Write

CVE-2023-51971

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-9.8||CRITICAL

EPSS-0.24% / 47.49%

||

7 Day CHG~0.00%

Published-10 Jan, 2024 | 00:00

Updated-03 Jun, 2025 | 15:15

Tenda AX1803 v1.0.0.1 contains a stack overflow via the adv.iptv.stbpvid parameter in the function getIptvInfo.

Vendor-n/a Tenda Technology Co., Ltd.

Product-ax1803 ax1803_firmware n/a

CWE ID-CWE-787

Out-of-bounds Write

CVE-2023-51962

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-9.8||CRITICAL

EPSS-0.26% / 48.83%

||

7 Day CHG~0.00%

Published-10 Jan, 2024 | 00:00

Updated-17 Apr, 2025 | 16:15

Tenda AX1803 v1.0.0.1 contains a stack overflow via the iptv.stb.mode parameter in the function setIptvInfo.

Vendor-n/a Tenda Technology Co., Ltd.

Product-ax1803_firmware ax1803 n/a

CWE ID-CWE-787

Out-of-bounds Write

CVE-2023-51965

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-9.8||CRITICAL

EPSS-0.24% / 47.49%

||

7 Day CHG~0.00%

Published-10 Jan, 2024 | 00:00

Updated-20 Jun, 2025 | 16:15

Tenda AX1803 v1.0.0.1 contains a stack overflow via the adv.iptv.stbpvid parameter in the function setIptvInfo.

Vendor-n/a Tenda Technology Co., Ltd.

Product-ax1803_firmware ax1803 n/a

CWE ID-CWE-787

Out-of-bounds Write

CVE-2023-51969

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-9.8||CRITICAL

EPSS-0.26% / 48.83%

||

7 Day CHG~0.00%

Published-10 Jan, 2024 | 00:00

Updated-20 Jun, 2025 | 16:15

Tenda AX1803 v1.0.0.1 contains a stack overflow via the iptv.city.vlan parameter in the function getIptvInfo.

Vendor-n/a Tenda Technology Co., Ltd.

Product-ax1803_firmware ax1803 n/a

CWE ID-CWE-787

Out-of-bounds Write

CVE-2023-52309

Matching Score-4

Assigner-Baidu, Inc.

View Details

Matching Score-4

Assigner-Baidu, Inc.

CVSS Score-8.2||HIGH

EPSS-0.13% / 32.07%

||

7 Day CHG~0.00%

Published-03 Jan, 2024 | 08:14

Updated-06 Sep, 2024 | 17:24

Heap buffer overflow in paddle.repeat_interleave

Heap buffer overflow in paddle.repeat_interleave in PaddlePaddle before 2.6.0. This flaw can lead to a denial of service, information disclosure, or more damage is possible.

Vendor-paddlepaddle PaddlePaddle

Product-paddlepaddle PaddlePaddle

CWE ID-CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

CWE ID-CWE-787

Out-of-bounds Write

CVE-2023-51954

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation