# CVE-2024-12649: Memory corruption in Color imageCLASS LBP632Cdw

> A buffer overflow in XPS font processing allows network attackers to execute arbitrary code or cause denial of service on affected Canon printers.

- **Severity:** Critical 9.8 (`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`)
- **Exploited in the wild:** Not known
- **Login needed:** Not needed
- **Attackable:** Over the internet
- **Victim action needed:** Not needed
- **Fix available:** No
- **Published:** 28 Jan 2025
- **Updated:** 28 Jan 2025
- **Also known as:** GHSA-327q-mmg5-jm77

## What is CVE-2024-12649?

CVE-2024-12649 is a critical memory corruption vulnerability in Canon Inc. Color imageCLASS LBP632Cdw, published on 28 Jan 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

### Official description

Buffer overflow in XPS data font processing of Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code. *: Satera MF656Cdw/Satera MF654Cdw firmware v05.04 and earlier sold in Japan. Color imageCLASS MF656Cdw/Color imageCLASS MF654Cdw/Color imageCLASS MF653Cdw/Color imageCLASS MF652Cdw/Color imageCLASS LBP633Cdw/Color imageCLASS LBP632Cdw firmware v05.04 and earlier sold in US. i-SENSYS MF657Cdw/i-SENSYS MF655Cdw/i-SENSYS MF651Cdw/i-SENSYS LBP633Cdw/i-SENSYS LBP631Cdw firmware v05.04 and earlier sold in Europe.

Weakness: CWE-787 (Out-of-bounds Write)

## Which versions are affected by CVE-2024-12649?

It affects 22 products.


Products: Canon Lbp1238 Ii Firmware, Canon Lbp1440 Firmware, Canon Lbp236dw Firmware, Canon Lbp237dw Firmware, Canon Lbp246dw Firmware, Canon Lbp247dw Firmware, Canon Lbp632cdw Firmware, Canon Lbp633cdw Firmware, Canon Mf1238 Ii Firmware, Canon Mf1440 Firmware, Canon Mf1643i Ii Firmware, Canon Mf1643if Ii Firmware, Canon Mf451dw Firmware, Canon Mf452dw Firmware, Canon Mf453dw Firmware, Canon Mf455dw Firmware, Canon Mf462dw Firmware, Canon Mf465dw Firmware, Canon Mf652cw Firmware, Canon Mf653cdw Firmware and 2 more.

## How do I fix CVE-2024-12649?

No fix has been published for CVE-2024-12649 yet. Limit exposure of the affected software until one is available.

## Is CVE-2024-12649 being exploited?

There is no known exploitation of CVE-2024-12649 in the wild and no public exploit code.

## Other vulnerabilities in Canon Inc. Color imageCLASS LBP632Cdw

- [CVE-2024-12647](https://insights.sbomify.com/CVE-2024-12647/): Memory corruption in Color imageCLASS LBP632Cdw (critical 9.8)
- [CVE-2024-12648](https://insights.sbomify.com/CVE-2024-12648/): Memory corruption in Color imageCLASS LBP632Cdw (critical 9.8)
- [CVE-2025-14231](https://insights.sbomify.com/CVE-2025-14231/): Memory corruption in 1238P II (critical 9.3)
- [CVE-2025-14232](https://insights.sbomify.com/CVE-2025-14232/): Memory corruption in 1238P II (critical 9.3)
- [CVE-2025-14233](https://insights.sbomify.com/CVE-2025-14233/): Memory corruption in 1238P II (critical 9.3)

## Fix prompt for AI coding agents

```text
Check this codebase for CVE-2024-12649 and fix it if it is affected.

What it is: CVE-2024-12649 is a critical memory corruption vulnerability in Canon Inc. Color imageCLASS LBP632Cdw, published on 28 Jan 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Exploitation: There is no known exploitation of CVE-2024-12649 in the wild and no public exploit code.

Affected product: Canon Inc. Color imageCLASS LBP632Cdw. No package-level version data is available, so check the vendor advisory linked from the reference page.

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/CVE-2024-12649/ (Markdown: https://insights.sbomify.com/CVE-2024-12649/index.md)
```

## Sources

- CVE record: https://www.cve.org/CVERecord?id=CVE-2024-12649
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-12649
- OSV: https://osv.dev/vulnerability/CVE-2024-12649

---
From sbomify Insights: https://insights.sbomify.com/CVE-2024-12649/
Summaries are generated and may contain mistakes; the official description above is the record.