CVE-2025-14233: canon inc. 1238i ii Release of Invalid Pointer or Reference

Vulnerability summary

CVE-2025-14233 is a critical (CVSS 9.8) Release of Invalid Pointer or Reference vulnerability in canon inc. 1238i ii. EPSS estimates a 0.83% chance of exploitation in the next 30 days, higher than 56.9% of scored vulnerabilities.

Timeline

1. 15-01-2026
   PublishedVulnerability first disclosed.
2. 26-02-2026
   Last modifiedVulnerability information updated.

Description

Invalid free in CPCA file deletion processing on Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code. *: Satera LBP670C Series/Satera MF750C Series firmware v06.02 and earlier sold in Japan.Color imageCLASS LBP630C/Color imageCLASS MF650C Series/imageCLASS LBP230 Series/imageCLASS X LBP1238 II/imageCLASS MF450 Series/imageCLASS X MF1238 II/imageCLASS X MF1643i II/imageCLASS X MF1643iF II firmware v06.02 and earlier sold in US.i-SENSYS LBP630C Series/i-SENSYS MF650C Series/i-SENSYS LBP230 Series/1238P II/1238Pr II/i-SENSYS MF450 Series/i-SENSYS MF550 Series/1238i II/1238iF II/imageRUNNER 1643i II/imageRUNNER 1643iF II firmware v06.02 and earlier sold in Europe.

• CWE-763Release of Invalid Pointer or ReferenceThe product attempts to return a memory resource to the system, but it calls the wrong release function or calls the appropriate release function incorrectly.