{"schemaVersion":3,"id":"CVE-2024-12647","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"Buffer overflow in CPCA font download processing of Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code. *: Satera MF656Cdw/Satera MF654Cdw firmware v05.04 and earlier sold in Japan. Color imageCLASS MF656Cdw/Color imageCLASS MF654Cdw/Color imageCLASS MF653Cdw/Color imageCLASS MF652Cdw/Color imageCLASS LBP633Cdw/Color imageCLASS LBP632Cdw firmware v05.04 and earlier sold in US. i-SENSYS MF657Cdw/i-SENSYS MF655Cdw/i-SENSYS MF651Cdw/i-SENSYS LBP633Cdw/i-SENSYS LBP631Cdw firmware v05.04 and earlier sold in Europe.","dates":{"published":"2025-01-28T00:38:17.973Z","modified":"2025-01-28T15:17:41.020Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":9.8,"severity":"critical","version":"3.1","versionLabel":"v3.1","source":"CVE.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":9.8,"severity":"critical","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":9.8,"severity":"critical","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.01202,"percentile":0.67805,"severity":"low","asOf":"2026-10-20T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-20T00:00:00.000Z","baselineScore":0.01202},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.01202,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.01202,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.01202,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.01202,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.01202,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.01202,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.01202,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.01202,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.01202,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.01202,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.01202,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.01202,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.01202,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.01202,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.01202,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.01202,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.01202,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.01202,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.01202,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.01202,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.01202,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.01202,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.01202,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.01202,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.01202,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.01202,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.01202,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.01202,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.01202,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.01202,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.01202,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.01202,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.01202,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.01202,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.01202,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.01202,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.01202,"percentile":0.67805}],"last30":[{"date":"2026-09-20T00:00:00.000Z","score":0.01202,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.01202,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.01202,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.01202,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.01202,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.01202,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.01202,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.01202,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.01202,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.01202,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.01202,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.01202,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.01202,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.01202,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.01202,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.01202,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.01202,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.01202,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.01202,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.01202,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.01202,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.01202,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.01202,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.01202,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.01202,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.01202,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.01202,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.01202,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.01202,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.01202,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.01202,"percentile":0.67805}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-787","name":"Out-of-bounds Write","description":"The product writes data past the end, or before the beginning, of the intended buffer.","type":"weakness","status":"Draft","abstraction":"Base","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/787.html"}],"affected":[{"vendor":"canon inc.","product":"color imageclass lbp632cdw","name":"Color imageCLASS LBP632Cdw","label":"color imageclass lbp632cdw","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"05.04 and earlier","noFixRecorded":false,"fixedIn":null}],"versionsText":"05.04 and earlier","eol":null,"hubHref":"/vendor/canon_inc/color_imageclass_lbp632cdw"},{"vendor":"canon inc.","product":"color imageclass lbp633cdw","name":"Color imageCLASS LBP633Cdw","label":"color imageclass lbp633cdw","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"05.04 and earlier","noFixRecorded":false,"fixedIn":null}],"versionsText":"05.04 and earlier","eol":null,"hubHref":"/vendor/canon_inc/color_imageclass_lbp633cdw"},{"vendor":"canon inc.","product":"color imageclass mf652cdw","name":"Color imageCLASS MF652Cdw","label":"color imageclass mf652cdw","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"05.04 and earlier","noFixRecorded":false,"fixedIn":null}],"versionsText":"05.04 and earlier","eol":null,"hubHref":"/vendor/canon_inc/color_imageclass_mf652cdw"},{"vendor":"canon inc.","product":"color imageclass mf653cdw","name":"Color imageCLASS MF653Cdw","label":"color imageclass mf653cdw","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"05.04 and earlier","noFixRecorded":false,"fixedIn":null}],"versionsText":"05.04 and earlier","eol":null,"hubHref":"/vendor/canon_inc/color_imageclass_mf653cdw"},{"vendor":"canon inc.","product":"color imageclass mf654cdw","name":"Color imageCLASS MF654Cdw","label":"color imageclass mf654cdw","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"05.04 and earlier","noFixRecorded":false,"fixedIn":null}],"versionsText":"05.04 and earlier","eol":null,"hubHref":"/vendor/canon_inc/color_imageclass_mf654cdw"},{"vendor":"canon inc.","product":"color imageclass mf656cdw","name":"Color imageCLASS MF656Cdw","label":"color imageclass mf656cdw","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"05.04 and earlier","noFixRecorded":false,"fixedIn":null}],"versionsText":"05.04 and earlier","eol":null,"hubHref":"/vendor/canon_inc/color_imageclass_mf656cdw"},{"vendor":"canon inc.","product":"i-sensys lbp631cdw","name":"i-SENSYS LBP631Cdw","label":"i-sensys lbp631cdw","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"05.04 and earlier","noFixRecorded":false,"fixedIn":null}],"versionsText":"05.04 and earlier","eol":null,"hubHref":"/vendor/canon_inc/i-sensys_lbp631cdw"},{"vendor":"canon inc.","product":"i-sensys lbp633cdw","name":"i-SENSYS LBP633Cdw","label":"i-sensys lbp633cdw","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"05.04 and earlier","noFixRecorded":false,"fixedIn":null}],"versionsText":"05.04 and earlier","eol":null,"hubHref":"/vendor/canon_inc/i-sensys_lbp633cdw"},{"vendor":"canon inc.","product":"i-sensys mf651cdw","name":"i-SENSYS MF651Cdw","label":"i-sensys mf651cdw","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"05.04 and earlier","noFixRecorded":false,"fixedIn":null}],"versionsText":"05.04 and earlier","eol":null,"hubHref":"/vendor/canon_inc/i-sensys_mf651cdw"},{"vendor":"canon inc.","product":"i-sensys mf655cdw","name":"i-SENSYS MF655Cdw","label":"i-sensys mf655cdw","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"05.04 and earlier","noFixRecorded":false,"fixedIn":null}],"versionsText":"05.04 and earlier","eol":null,"hubHref":"/vendor/canon_inc/i-sensys_mf655cdw"},{"vendor":"canon inc.","product":"i-sensys mf657cdw","name":"i-SENSYS MF657Cdw","label":"i-sensys mf657cdw","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"05.04 and earlier","noFixRecorded":false,"fixedIn":null}],"versionsText":"05.04 and earlier","eol":null,"hubHref":"/vendor/canon_inc/i-sensys_mf657cdw"},{"vendor":"canon inc.","product":"satera mf654cdw","name":"Satera MF654Cdw","label":"satera mf654cdw","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"05.04 and earlier","noFixRecorded":false,"fixedIn":null}],"versionsText":"05.04 and earlier","eol":null,"hubHref":"/vendor/canon_inc/satera_mf654cdw"},{"vendor":"canon inc.","product":"satera mf656cdw","name":"Satera MF656Cdw","label":"satera mf656cdw","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"05.04 and earlier","noFixRecorded":false,"fixedIn":null}],"versionsText":"05.04 and earlier","eol":null,"hubHref":"/vendor/canon_inc/satera_mf656cdw"},{"vendor":"canon","product":"lbp1238_ii_firmware","name":"lbp1238 ii firmware","label":"lbp1238_ii_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≤ 05.04","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 05.04","eol":null,"hubHref":"/vendor/canon/lbp1238_ii"},{"vendor":"canon","product":"lbp1440_firmware","name":"lbp1440 firmware","label":"lbp1440_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≤ 05.04","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 05.04","eol":null,"hubHref":"/vendor/canon/lbp1440"},{"vendor":"canon","product":"lbp236dw_firmware","name":"lbp236dw firmware","label":"lbp236dw_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≤ 05.04","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 05.04","eol":null,"hubHref":"/vendor/canon/lbp236dw"},{"vendor":"canon","product":"lbp237dw_firmware","name":"lbp237dw firmware","label":"lbp237dw_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≤ 05.04","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 05.04","eol":null,"hubHref":"/vendor/canon/lbp237dw"},{"vendor":"canon","product":"lbp246dw_firmware","name":"lbp246dw firmware","label":"lbp246dw_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≤ 05.04","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 05.04","eol":null,"hubHref":"/vendor/canon/lbp246dw"},{"vendor":"canon","product":"lbp247dw_firmware","name":"lbp247dw firmware","label":"lbp247dw_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≤ 05.04","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 05.04","eol":null,"hubHref":"/vendor/canon/lbp247dw"},{"vendor":"canon","product":"lbp632cdw_firmware","name":"lbp632cdw firmware","label":"lbp632cdw_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≤ 05.04","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 05.04","eol":null,"hubHref":"/vendor/canon/lbp632cdw"},{"vendor":"canon","product":"lbp633cdw_firmware","name":"lbp633cdw firmware","label":"lbp633cdw_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≤ 05.04","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 05.04","eol":null,"hubHref":"/vendor/canon/lbp633cdw"},{"vendor":"canon","product":"mf1238_ii_firmware","name":"mf1238 ii firmware","label":"mf1238_ii_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≤ 05.04","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 05.04","eol":null,"hubHref":"/vendor/canon/mf1238_ii"},{"vendor":"canon","product":"mf1440_firmware","name":"mf1440 firmware","label":"mf1440_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≤ 05.04","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 05.04","eol":null,"hubHref":"/vendor/canon/mf1440"},{"vendor":"canon","product":"mf1643i_ii_firmware","name":"mf1643i ii firmware","label":"mf1643i_ii_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≤ 05.04","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 05.04","eol":null,"hubHref":"/vendor/canon/mf1643i_ii"},{"vendor":"canon","product":"mf1643if_ii_firmware","name":"mf1643if ii firmware","label":"mf1643if_ii_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≤ 05.04","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 05.04","eol":null,"hubHref":"/vendor/canon/mf1643if_ii"},{"vendor":"canon","product":"mf451dw_firmware","name":"mf451dw firmware","label":"mf451dw_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≤ 05.04","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 05.04","eol":null,"hubHref":"/vendor/canon/mf451dw"},{"vendor":"canon","product":"mf452dw_firmware","name":"mf452dw firmware","label":"mf452dw_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≤ 05.04","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 05.04","eol":null,"hubHref":"/vendor/canon/mf452dw"},{"vendor":"canon","product":"mf453dw_firmware","name":"mf453dw firmware","label":"mf453dw_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≤ 05.04","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 05.04","eol":null,"hubHref":"/vendor/canon/mf453dw"},{"vendor":"canon","product":"mf455dw_firmware","name":"mf455dw firmware","label":"mf455dw_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≤ 05.04","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 05.04","eol":null,"hubHref":"/vendor/canon/mf455dw"},{"vendor":"canon","product":"mf462dw_firmware","name":"mf462dw firmware","label":"mf462dw_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≤ 05.04","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 05.04","eol":null,"hubHref":"/vendor/canon/mf462dw"},{"vendor":"canon","product":"mf465dw_firmware","name":"mf465dw firmware","label":"mf465dw_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≤ 05.04","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 05.04","eol":null,"hubHref":"/vendor/canon/mf465dw"},{"vendor":"canon","product":"mf652cw_firmware","name":"mf652cw firmware","label":"mf652cw_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≤ 05.04","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 05.04","eol":null,"hubHref":"/vendor/canon/mf652cw"},{"vendor":"canon","product":"mf653cdw_firmware","name":"mf653cdw firmware","label":"mf653cdw_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≤ 05.04","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 05.04","eol":null,"hubHref":"/vendor/canon/mf653cdw"},{"vendor":"canon","product":"mf654cdw_firmware","name":"mf654cdw firmware","label":"mf654cdw_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≤ 05.04","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 05.04","eol":null,"hubHref":"/vendor/canon/mf654cdw"},{"vendor":"canon","product":"mf656cdw_firmware","name":"mf656cdw firmware","label":"mf656cdw_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≤ 05.04","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 05.04","eol":null,"hubHref":"/vendor/canon/mf656cdw"}],"affectedCount":35,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://psirt.canon/advisory-information/cp2025-001/","label":"psirt.canon/advisory-information/cp2025-001/","hostname":"psirt.canon","tags":["Vendor Advisory"]},{"url":"https://canon.jp/support/support-info/250127vulnerability-response","label":"canon.jp/support/support-info/250127vulnerability-response","hostname":"canon.jp","tags":["Vendor Advisory"]},{"url":"https://www.usa.canon.com/support/canon-product-advisories/service-notice-regarding-vulnerability-measure-against-buffer-overflow-for-laser-printers-and-small-office-multifunctional-printers","label":"www.usa.canon.com/support/…","hostname":"www.usa.canon.com","tags":["Vendor Advisory"]},{"url":"https://www.canon-europe.com/support/product-security/#news","label":"www.canon-europe.com/support/product-security/","hostname":"www.canon-europe.com","tags":["Vendor Advisory"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2025-01-28T00:38:17.973Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2025-01-28T15:17:41.020Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":70,"level":"high","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-20T22:20:14.734Z","stale":false,"partial":false}}