Loading story…
Canon disclosed patches for multiple remote code execution vulnerabilities affecting the imageCLASS MF654Cdw printer, following coordinated publication through Zero Day Initiative advisories tied to Pwn2Own. The flaws allow network-adjacent, unauthenticated attackers to execute arbitrary code in the context of the device, and each advisory assigns a CVSS 8.8 severity rating. The vulnerabilities were reported in November 2025 and publicly released in March 2026, with Canon directing customers to its product security guidance for updates.
The disclosed issues affect several distinct attack surfaces on the printer. CVE-2025-14232 is a stack-based buffer overflow in XPS file parsing, CVE-2025-14235 is an out-of-bounds write in TrueType font parsing, CVE-2025-14234 is a heap-based buffer overflow triggered by a crafted font in a PJCC request within the CADM service listening on TCP/9013, and CVE-2025-14236 is a stack-based buffer overflow in the dtdc_addr_importSub method. Together, the advisories indicate that malicious print content or protocol requests could be used to compromise exposed devices, reinforcing the need to patch internet-reachable and internally accessible printers promptly.
See affected versions and whether adversaries are exploiting it.
4 events from the most recent confirmed update back to the earliest known activity.
On March 23, 2026, Trend Micro's Zero Day Initiative published advisory ZDI-26-222 for CVE-2025-14233, a high-severity remote code execution vulnerability in the Canon imageCLASS MF654Cdw BJNP service. The flaw allows unauthenticated network-adjacent attackers to trigger memory corruption and execute arbitrary code, and Canon had already issued an update to fix it.
On March 16, 2026, Trend Micro's Zero Day Initiative published advisories ZDI-26-204, ZDI-26-205, ZDI-26-206, and ZDI-26-207 covering four high-severity remote code execution flaws in the Canon imageCLASS MF654Cdw. The disclosures credited SHIMIZU Yutaro, Team ANHTUD, PHP HOOLIGANS, and TwinkleStar03, and noted the issues were highlighted in the Pwn2Own context.
Before public disclosure, Canon released updates to remediate the four high-severity MF654Cdw vulnerabilities tracked as CVE-2025-14232, CVE-2025-14234, CVE-2025-14235, and CVE-2025-14236. The fixes addressed unauthenticated network-adjacent code execution risks affecting the printer.
On November 11, 2025, multiple researchers reported four distinct remote code execution vulnerabilities in the Canon imageCLASS MF654Cdw printer to Canon. The issues included flaws in the XPS parser, CADM service, TrueType font parsing, and dtdc_addr_importSub method.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
5 references tracked. Mallory keeps watching after this page renders.
zerodayinitiative.com
Open sourcezerodayinitiative.com
Open sourcezerodayinitiative.com
Open sourcezerodayinitiative.com
Open sourcezerodayinitiative.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple vulnerabilities in the Common Unix Printing System (**CUPS**) were publicly disclosed, including flaws that can be chained into **remote code execution** on affected Linux and Unix systems. Reporting described the issue as a critical CUPS-based RCE risk, while an `oss-security` disclosure listed multiple **CVEs** tied to the print server and related components, expanding the scope from a single bug to a broader set of weaknesses in widely deployed printing infrastructure. Subsequent coverage said AI agents were able to identify vulnerabilities in the same Linux and Unix print server stack, underscoring how quickly offensive research techniques can surface exploitable flaws in foundational services. Because CUPS is commonly enabled across enterprise and workstation environments, the disclosures raised concern that exposed or reachable print services could provide attackers with a path to execute code remotely, making patching, service exposure review, and printer-related attack surface reduction urgent priorities.
Jul 12, 2026
A critical vulnerability in Apache Tomcat, identified as CVE-2025-48989, allows remote, unauthenticated attackers to degrade HTTP/2 service performance, potentially leading to a denial-of-service (DoS) condition. The flaw, caused by improper resource shutdown or release, affects Tomcat versions 11.0.0-M1 through 11.0.9, 10.1.0-M1 through 10.1.43, and 9.0.0.M1 through 9.0.107, with patches available in subsequent releases. F5 has confirmed that while some of its products use vulnerable Tomcat versions, not all are affected due to lack of HTTP/2 support. Organizations are advised to upgrade to the fixed versions to mitigate risk. Separately, a use-after-free vulnerability in CUPS (CVE-2023-34241) impacts versions from 2.0.0 up to but not including 2.4.6, potentially allowing attackers to corrupt data, cause DoS, or execute unauthorized code. The issue arises from improper memory handling during logging operations after a connection is closed. Additionally, research has highlighted a severe vulnerability (CVE-2024-12649, CVSS 9.8) in Canon printers, where attackers can execute malicious code simply by sending a specially crafted XPS file containing a malicious TrueType Font (TTF). These vulnerabilities underscore the increasing focus of attackers on networked devices like printers and print services, which often lack robust endpoint protection and can serve as entry points into organizational networks.
Jun 29, 2026
Researchers disclosed a high-impact vulnerability chain in **OpenPrinting CUPS** affecting version `2.4.16` and earlier that can let an unauthenticated remote attacker progress from network-reachable print-job submission to **code execution as `lp`** and then to a **root-level file overwrite**. The chain combines `CVE-2026-34980`, which abuses anonymous `Print-Job` requests against a shared PostScript queue, with `CVE-2026-34990`, an authorization flaw that lets a local unprivileged user coerce `cupsd` into authenticating to an attacker-controlled localhost IPP service and reuse a print admin token to overwrite root-owned files. Public advisories and proof-of-concept details were released by researcher Asim Viladi Oglu Manizada and OpenPrinting, and fixes were committed publicly even though no patched release was yet available. Defenders were urged to reduce exposure immediately because exploitation depends on reachable `cupsd` services, legacy shared queues, and permissive submission behavior rather than user interaction. Recommended mitigations include disabling or restricting network exposure of CUPS, requiring authentication for shared queue submissions, disabling shared legacy queues where possible, and confining the service with **SELinux** or **AppArmor**. Follow-on discussion noted that removing CUPS outright may be impractical on some Ubuntu systems because `cupsd` is commonly installed by default and intertwined with other packages, making service isolation and firewalling more realistic short-term controls.
Jun 29, 2026