{"id":"CVE-2024-12647","aliases":["EUVD-2024-51022","GHSA-p8vf-p5g9-f6j7"],"status":"published","title":"Buffer overflow in CPCA font download processing of Small Office Multifunction Printers and Laser...","description":"Buffer overflow in CPCA font download processing of Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code. *: Satera MF656Cdw/Satera MF654Cdw firmware v05.04 and earlier sold in Japan. Color imageCLASS MF656Cdw/Color imageCLASS MF654Cdw/Color imageCLASS MF653Cdw/Color imageCLASS MF652Cdw/Color imageCLASS LBP633Cdw/Color imageCLASS LBP632Cdw firmware v05.04 and earlier sold in US. i-SENSYS MF657Cdw/i-SENSYS MF655Cdw/i-SENSYS MF651Cdw/i-SENSYS LBP633Cdw/i-SENSYS LBP631Cdw firmware v05.04 and earlier sold in Europe.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.01194,"percentile":0.6843,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-787"],"published":"2025-01-28T00:38:17Z","modified":"2026-06-17T07:00:12Z","products":[{"vendor":"canon","product":"lbp1238_ii_firmware"},{"vendor":"canon","product":"lbp1440_firmware"},{"vendor":"canon","product":"lbp236dw_firmware"},{"vendor":"canon","product":"lbp237dw_firmware"},{"vendor":"canon","product":"lbp246dw_firmware"},{"vendor":"canon","product":"lbp247dw_firmware"},{"vendor":"canon","product":"lbp632cdw_firmware"},{"vendor":"canon","product":"lbp633cdw_firmware"},{"vendor":"canon","product":"mf1238_ii_firmware"},{"vendor":"canon","product":"mf1440_firmware"},{"vendor":"canon","product":"mf1643i_ii_firmware"},{"vendor":"canon","product":"mf1643if_ii_firmware"},{"vendor":"canon","product":"mf451dw_firmware"},{"vendor":"canon","product":"mf452dw_firmware"},{"vendor":"canon","product":"mf453dw_firmware"},{"vendor":"canon","product":"mf455dw_firmware"},{"vendor":"canon","product":"mf462dw_firmware"},{"vendor":"canon","product":"mf465dw_firmware"},{"vendor":"canon","product":"mf652cw_firmware"},{"vendor":"canon","product":"mf653cdw_firmware"},{"vendor":"canon","product":"mf654cdw_firmware"},{"vendor":"canon","product":"mf656cdw_firmware"},{"vendor":"canon inc.","product":"color imageclass lbp632cdw"},{"vendor":"canon inc.","product":"color imageclass lbp633cdw"},{"vendor":"canon inc.","product":"color imageclass mf652cdw"},{"vendor":"canon inc.","product":"color imageclass mf653cdw"},{"vendor":"canon inc.","product":"color imageclass mf654cdw"},{"vendor":"canon inc.","product":"color imageclass mf656cdw"},{"vendor":"canon inc.","product":"i-sensys lbp631cdw"},{"vendor":"canon inc.","product":"i-sensys lbp633cdw"},{"vendor":"canon inc.","product":"i-sensys mf651cdw"},{"vendor":"canon inc.","product":"i-sensys mf655cdw"},{"vendor":"canon inc.","product":"i-sensys mf657cdw"},{"vendor":"canon inc.","product":"satera mf654cdw"},{"vendor":"canon inc.","product":"satera mf656cdw"}],"references":[{"url":"https://psirt.canon/advisory-information/cp2025-001/","tags":["vendor-advisory","Vendor Advisory"]},{"url":"https://canon.jp/support/support-info/250127vulnerability-response","tags":["vendor-advisory","Vendor Advisory"]},{"url":"https://www.usa.canon.com/support/canon-product-advisories/service-notice-regarding-vulnerability-measure-against-buffer-overflow-for-laser-printers-and-small-office-multifunctional-printers","tags":["vendor-advisory","Vendor Advisory"]},{"url":"https://www.canon-europe.com/support/product-security/#news","tags":["vendor-advisory","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-12647"},{"url":"https://psirt.canon/advisory-information/cp2025-001"},{"url":"https://github.com/advisories/GHSA-p8vf-p5g9-f6j7"}],"sources":{"cve":[{"id":"CVE-2024-12647","description":"Buffer overflow in CPCA font download processing of Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code. *: Satera MF656Cdw/Satera MF654Cdw firmware v05.04 and earlier sold in Japan. Color imageCLASS MF656Cdw/Color imageCLASS MF654Cdw/Color imageCLASS MF653Cdw/Color imageCLASS MF652Cdw/Color imageCLASS LBP633Cdw/Color imageCLASS LBP632Cdw firmware v05.04 and earlier sold in US. i-SENSYS MF657Cdw/i-SENSYS MF655Cdw/i-SENSYS MF651Cdw/i-SENSYS LBP633Cdw/i-SENSYS LBP631Cdw firmware v05.04 and earlier sold in Europe.","status":"published","published":"2025-01-28T00:38:17.973Z","modified":"2025-01-28T15:17:41.02Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:34:12.635756Z"}],"euvd":[{"id":"EUVD-2024-51022","description":"Buffer overflow in CPCA font download processing of Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code. *: Satera MF656Cdw/Satera MF654Cdw firmware v05.04 and earlier sold in Japan. Color imageCLASS MF656Cdw/Color imageCLASS MF654Cdw/Color imageCLASS MF653Cdw/Color imageCLASS MF652Cdw/Color imageCLASS LBP633Cdw/Color imageCLASS LBP632Cdw firmware v05.04 and earlier sold in US. i-SENSYS MF657Cdw/i-SENSYS MF655Cdw/i-SENSYS MF651Cdw/i-SENSYS LBP633Cdw/i-SENSYS LBP631Cdw firmware v05.04 and earlier sold in Europe.","status":"published","published":"2025-01-28T00:38:17Z","modified":"2025-01-28T15:17:41Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-03T00:04:11.814906Z"}],"ghsa":[{"id":"GHSA-p8vf-p5g9-f6j7","title":"Buffer overflow in CPCA font download processing of Small Office Multifunction Printers and Laser...","description":"Buffer overflow in CPCA font download processing of Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code. *: Satera MF656Cdw/Satera MF654Cdw firmware v05.04 and earlier sold in Japan. Color imageCLASS MF656Cdw/Color imageCLASS MF654Cdw/Color imageCLASS MF653Cdw/Color imageCLASS MF652Cdw/Color imageCLASS LBP633Cdw/Color imageCLASS LBP632Cdw firmware v05.04 and earlier sold in US. i-SENSYS MF657Cdw/i-SENSYS MF655Cdw/i-SENSYS MF651Cdw/i-SENSYS LBP633Cdw/i-SENSYS LBP631Cdw firmware v05.04 and earlier sold in Europe.","status":"published","published":"2025-01-28T03:31:13Z","modified":"2025-01-28T03:31:23Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:59:41.697715Z"}],"nvd":[{"id":"CVE-2024-12647","description":"Buffer overflow in CPCA font download processing of Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code. *: Satera MF656Cdw/Satera MF654Cdw firmware v05.04 and earlier sold in Japan. Color imageCLASS MF656Cdw/Color imageCLASS MF654Cdw/Color imageCLASS MF653Cdw/Color imageCLASS MF652Cdw/Color imageCLASS LBP633Cdw/Color imageCLASS LBP632Cdw firmware v05.04 and earlier sold in US. i-SENSYS MF657Cdw/i-SENSYS MF655Cdw/i-SENSYS MF651Cdw/i-SENSYS LBP633Cdw/i-SENSYS LBP631Cdw firmware v05.04 and earlier sold in Europe.","status":"published","published":"2025-01-28T01:15:08.56Z","modified":"2026-06-17T07:00:12.03Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:10:43.581383Z"}]}}