Loading story…
A critical vulnerability in Apache Tomcat, identified as CVE-2025-48989, allows remote, unauthenticated attackers to degrade HTTP/2 service performance, potentially leading to a denial-of-service (DoS) condition. The flaw, caused by improper resource shutdown or release, affects Tomcat versions 11.0.0-M1 through 11.0.9, 10.1.0-M1 through 10.1.43, and 9.0.0.M1 through 9.0.107, with patches available in subsequent releases. F5 has confirmed that while some of its products use vulnerable Tomcat versions, not all are affected due to lack of HTTP/2 support. Organizations are advised to upgrade to the fixed versions to mitigate risk.
Separately, a use-after-free vulnerability in CUPS (CVE-2023-34241) impacts versions from 2.0.0 up to but not including 2.4.6, potentially allowing attackers to corrupt data, cause DoS, or execute unauthorized code. The issue arises from improper memory handling during logging operations after a connection is closed. Additionally, research has highlighted a severe vulnerability (CVE-2024-12649, CVSS 9.8) in Canon printers, where attackers can execute malicious code simply by sending a specially crafted XPS file containing a malicious TrueType Font (TTF). These vulnerabilities underscore the increasing focus of attackers on networked devices like printers and print services, which often lack robust endpoint protection and can serve as entry points into organizational networks.
See affected versions and whether adversaries are exploiting it.
5 events from the most recent confirmed update back to the earliest known activity.
F5 published product advisory K000157836 regarding CUPS vulnerability CVE-2023-34241. No further technical details were provided in the reference content.
F5 published product advisory K000157302 regarding Apache Tomcat vulnerability CVE-2025-48989. No further technical details were provided in the reference content.
Canon recommended applying firmware updates and limiting printer internet exposure in response to CVE-2024-12649. Additional defensive guidance included network segmentation, disabling unused printer services, and using strong unique administrator passwords.
At Security Analyst Summit 2025, researcher Peter Geissler publicly described how a crafted XPS file containing a malicious TrueType font can trigger a stack buffer overflow and code execution on vulnerable Canon printers. The presentation highlighted that exploitation can occur even when printers are not internet-exposed if a user prints a malicious document from inside the network.
A critical Canon printer vulnerability, CVE-2024-12649, was identified affecting DryOS-based devices. The flaw involves insecure stack handling in the font-processing virtual machine and can lead to remote code execution via a crafted XPS document with a malicious TrueType font.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**Canon** disclosed patches for multiple **remote code execution** vulnerabilities affecting the *imageCLASS MF654Cdw* printer, following coordinated publication through **Zero Day Initiative** advisories tied to *Pwn2Own*. The flaws allow **network-adjacent, unauthenticated attackers** to execute arbitrary code in the context of the device, and each advisory assigns a **CVSS 8.8** severity rating. The vulnerabilities were reported in November 2025 and publicly released in March 2026, with Canon directing customers to its product security guidance for updates. The disclosed issues affect several distinct attack surfaces on the printer. **CVE-2025-14232** is a stack-based buffer overflow in **XPS** file parsing, **CVE-2025-14235** is an out-of-bounds write in **TrueType font** parsing, **CVE-2025-14234** is a heap-based buffer overflow triggered by a crafted font in a **PJCC** request within the **CADM** service listening on `TCP/9013`, and **CVE-2025-14236** is a stack-based buffer overflow in the `dtdc_addr_importSub` method. Together, the advisories indicate that malicious print content or protocol requests could be used to compromise exposed devices, reinforcing the need to patch internet-reachable and internally accessible printers promptly.
Jun 29, 2026
Multiple vulnerabilities in the Common Unix Printing System (**CUPS**) were publicly disclosed, including flaws that can be chained into **remote code execution** on affected Linux and Unix systems. Reporting described the issue as a critical CUPS-based RCE risk, while an `oss-security` disclosure listed multiple **CVEs** tied to the print server and related components, expanding the scope from a single bug to a broader set of weaknesses in widely deployed printing infrastructure. Subsequent coverage said AI agents were able to identify vulnerabilities in the same Linux and Unix print server stack, underscoring how quickly offensive research techniques can surface exploitable flaws in foundational services. Because CUPS is commonly enabled across enterprise and workstation environments, the disclosures raised concern that exposed or reachable print services could provide attackers with a path to execute code remotely, making patching, service exposure review, and printer-related attack surface reduction urgent priorities.
Jul 12, 2026
Two significant vulnerabilities have been identified in Apache Tomcat, each with distinct attack vectors and impacts. CVE-2025-61795 is an improper resource shutdown or release vulnerability that can lead to a denial-of-service (DoS) condition if temporary files from multipart uploads are not cleaned up promptly, potentially exhausting disk space and exposing sensitive data. This issue affects Tomcat versions 11.0.0-M1 through 11.0.11, 10.1.0-M1 through 10.1.46, 9.0.0.M1 through 9.0.109, and several end-of-life versions, with patches available in 11.0.12, 10.1.47, and 9.0.110 and later. CVE-2025-55752 is a relative path traversal vulnerability introduced by a regression in the fix for a previous bug, allowing attackers to bypass security constraints and potentially upload malicious files if specific, non-default configurations are present. This vulnerability affects Tomcat versions 11.0.0-M1 through 11.0.10, 10.1.0-M1 through 10.1.44, 9.0.0.M11 through 9.0.108, and certain EOL versions, with fixes in 11.0.11, 10.1.45, and 9.0.109 and later. Both vulnerabilities require prompt attention from administrators, especially those running affected Tomcat versions. The DoS vulnerability (CVE-2025-61795) can be exploited by attackers to exhaust server resources, while the path traversal flaw (CVE-2025-55752) could lead to remote code execution under specific conditions. Organizations are advised to upgrade to the latest patched versions to mitigate these risks and review their Tomcat configurations to ensure that non-default features such as HTTP PUT requests and URL rewriting are not unnecessarily enabled.
Jun 29, 2026