CVE-2025-14233 Memory corruption in 1238P II
An attacker on the network can trigger an invalid free in CPCA file deletion, causing the printer to become unresponsive or execute arbitrary code.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-14233?
CVE-2025-14233 is a critical memory corruption vulnerability in Canon Inc. 1238P II, published on 15 Jan 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Invalid free in CPCA file deletion processing on Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code. *: Satera LBP670C Series/Satera MF750C Series firmware v06.02 and earlier sold in Japan.Color imageCLASS LBP630C/Color imageCLASS MF650C Series/imageCLASS LBP230 Series/imageCLASS X LBP1238 II/imageCLASS MF450 Series/imageCLASS X MF1238 II/imageCLASS X MF1643i II/imageCLASS X MF1643iF II firmware v06.02 and earlier sold in US.i-SENSYS LBP630C Series/i-SENSYS MF650C Series/i-SENSYS LBP230 Series/1238P II/1238Pr II/i-SENSYS MF450 Series/i-SENSYS MF550 Series/1238i II/1238iF II/imageRUNNER 1643i II/imageRUNNER 1643iF II firmware v06.02 and earlier sold in Europe.
Weakness: CWE-763
Which versions are affected by CVE-2025-14233?
It affects 16 products.
Products include Canon Lbp1238 Ii Firmware, Canon Lbp236dw Firmware, Canon Lbp237dw Firmware, Canon Lbp632cdw Firmware, Canon Lbp633cdw Firmware, Canon Mf1238 Ii Firmware and 10 more.
How do I fix CVE-2025-14233?
No fix has been published for CVE-2025-14233 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2025-14233 being exploited?
There is no known exploitation of CVE-2025-14233 in the wild and no public exploit code.
Other vulnerabilities in Canon Inc. 1238P II
Sources
Also known as GHSA-8cgh-48g2-rj4j.