Canon vulnerabilities
We track 32 vulnerabilities in Canon products across 60+ products. 32 are rated high or critical, and none are known to be exploited. The most recent was published on January 16, 2026.
Latest Canon vulnerabilities
- 9.8 Critical severity
Satera LBP670C Series: Out-of-bounds Write
Buffer overflow in XPS font parse processing on Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code. *: Satera LBP670C Seri
- 9.8 Critical severity
Satera LBP670C Series: Out-of-bounds Write
Buffer overflow in Address Book attribute tag processing on Small Office Multifunction Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code. *: Satera LBP670C Series/Sate
- 9.8 Critical severity
Satera LBP670C Series: Out-of-bounds Write
Buffer overflow in XPS font fpgm data processing on Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code. *: Satera LBP670C
- 9.8 Critical severity
Satera LBP670C Series: Out-of-bounds Write
Buffer overflow in CPCA list processing on Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code. *: Satera LBP670C Series/Sa
- 9.8 Critical severity
Satera LBP670C Series: Release of Invalid Pointer or Reference
Invalid free in CPCA file deletion processing on Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code. *: Satera LBP670C Ser
- 9.8 Critical severity
Satera LBP670C Series: Out-of-bounds Write
Buffer overflow in XML processing of XPS file in Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code. *: Satera LBP670C Ser
- 9.8 Critical severity
Satera LBP670C Series: Out-of-bounds Write
Buffer overflow in print job processing by WSD on Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code. *: Satera LBP670C Se
- 9.8 Critical severity
Satera MF656Cdw: Out-of-bounds Write
Buffer overflow in WebService Authentication processing of Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code. *: Satera M
- 9.4 Critical severity
Generic Plus PCL6 Printer Driver: Out-of-bounds Write
Out-of-bounds vulnerability in EMF Recode processing of Generic Plus PCL6 Printer Driver / Generic Plus UFR II Printer Driver / Generic Plus LIPS4 Printer Driver / Generic Plus LIPSLX Printer Driver / Generic Plus PS Printer Driver / Generic FAX Printer Driver
- 9.8 Critical severity
Satera MF656Cdw: Out-of-bounds Write
Buffer overflow in XPS data font processing of Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code. *: Satera MF656Cdw/Sate
- 9.8 Critical severity
Satera MF656Cdw: Out-of-bounds Write
Buffer overflow in TIFF data EXIF tag processing of Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code. *: Satera MF656Cdw
- 9.8 Critical severity
Satera MF656Cdw: Out-of-bounds Write
Buffer overflow in CPCA font download processing of Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code. *: Satera MF656Cdw
- 9.8 Critical severity
Color imageCLASS MF740C Series: Out-of-bounds Write
Buffer overflow in identifier field of WSD probe request process of Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code.*:S
- 9.8 Critical severity
Satera MF750C Series: Out-of-bounds Write
Buffer overflow in CPCA PCFAX number process of Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code.*:Satera MF750C Series firmwa
- 9.8 Critical severity
Satera LBP670C Series: Out-of-bounds Write
Buffer overflow in CPCA Color LUT Resource Download process of Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code.*: Satera LBP6
- 9.8 Critical severity
Satera LBP670C Series: Out-of-bounds Write
Buffer overflow in SLP attribute request process of Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code.*: Satera LBP670C Series/
- 9.8 Critical severity
Satera LBP670C Series: Out-of-bounds Write
Buffer overflow in the Address Book username process in authentication of Mobile Device Function of Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to
- 9.8 Critical severity
Satera LBP670C Series: Out-of-bounds Write
Buffer overflow in WSD probe request process of Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code.*: Satera LBP670C Series/Sate
- 9.8 Critical severity
Satera LBP670C Series: Out-of-bounds Write
Buffer overflow in the Address Book password process in authentication of Mobile Device Function of Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to
- 9.8 Critical severity
Satera LBP670C Series: Out-of-bounds Write
Buffer overflow in CPCA PDL Resource Download process of Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code.*: Satera LBP670C Se
- 7.5 High severity
Canon Office/Small Office Multifunction…: Incorrect User Management
Unintentional change of settings during initial registration of system administrators which uses control protocols. The affected Office / Small Office Multifunction Printers and Laser Printers(*) may allow an attacker on the network segment to trigger unauthor
- 9.8 Critical severity
Canon Office/Small Office Multifunction…: Out-of-bounds Write
Buffer overflow in IPP sides attribute process of Office / Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code. *:Satera LB
- 9.8 Critical severity
Canon Office/Small Office Multifunction…: Out-of-bounds Write
Buffer overflow in IPP number-up attribute process of Office / Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code. *:Sater
- 9.8 Critical severity
Canon Office/Small Office Multifunction…: Out-of-bounds Write
Buffer overflow in NetBIOS QNAME registering and communication process of Office / Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arb
- 9.8 Critical severity
Canon Office/Small Office Multifunction…: Out-of-bounds Write
Buffer overflow in mDNS NSEC record registering process of Office / Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code. *:
- 9.8 Critical severity
Canon Office/Small Office Multifunction…: Out-of-bounds Write
Buffer overflow in the Address Book of Mobile Device function of Office / Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary co
- 9.8 Critical severity
Canon Office/Small Office Multifunction…: Out-of-bounds Write
Buffer overflow in CPCA Resource Download process of Office / Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code. *:Satera
- 8.8 High severity
imageCLASS MF644Cdw: Integer Overflow or Wraparound
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Canon imageCLASS MF644Cdw 10.03 printers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the BJNP service
- 8.8 High severity
imageCLASS MF644Cdw: Out-of-bounds Write
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Canon imageCLASS MF644Cdw 10.02 printers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the privet API.
- 9.8 Critical severity
imageCLASS MF644Cdw: Out-of-bounds Write
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Canon imageCLASS MF644Cdw 10.02 printers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the implementation of the
- 8.8 High severity
imageCLASS MF644Cdw: Out-of-bounds Write
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Canon imageCLASS MF644Cdw 10.02 printers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the CADM service
- 8.8 High severity
Irisnext: Improper Neutralization of Special Elements used in an Expression Language Statement
The BeanShell components of IRISNext through 9.8.28 allow execution of arbitrary commands on the target server by creating a custom search (or editing an existing/predefined search) of the documents. The search components permit adding BeanShell expressions th