CVE-2024-12649

CVE-2024-12649 is a buffer overflow vulnerability (CWE-787) in the XPS data font processing component of specific Canon Small Office Multifunction Printers and Laser Printers. Affected products include Satera MF656Cdw and MF654Cdw with firmware v05.04 and earlier sold in Japan; Color imageCLASS MF656Cdw, MF654Cdw, MF653Cdw, MF652Cdw, LBP633Cdw, and LBP632Cdw with firmware v05.04 and earlier sold in the US; and i-SENSYS MF657Cdw, MF655Cdw, MF651Cdw, LBP633Cdw, and LBP631Cdw with firmware v05.04 and earlier sold in Europe.

The vulnerability can be exploited by an unauthenticated attacker on the same network segment with low complexity and no user interaction required. Successful exploitation may cause the affected printer to become unresponsive (denial of service) or allow execution of arbitrary code, with a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflecting critical severity across confidentiality, integrity, and availability impacts.

Canon advisories, such as PSIRT advisory CP2025-001 and regional support notices from Japan, Europe, and the US, detail vulnerability responses and measures against this buffer overflow in laser printers and small office multifunction printers. Security practitioners should consult these resources for patching instructions and firmware updates.