CVE-2025-14233

CRITICAL
2026-01-16 f98c90f0-e9bd-4fa7-911b-51993f3571fd
9.8
CVSS 3.1
Share

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

2
Analysis Generated
Mar 12, 2026 - 21:54 vuln.today
CVE Published
Jan 16, 2026 - 00:16 nvd
CRITICAL 9.8

Tags

RCE Mf452dw Firmware Mf656cdw Firmware Mf1238 Ii Firmware Mf451dw Firmware Lbp1238 Ii Firmware Mf652cw Firmware Lbp632cdw Firmware Lbp237dw Firmware Mf1643if Ii Firmware Mf1643i Ii Firmware Lbp236dw Firmware Lbp633cdw Firmware Mf654cdw Firmware Mf453dw Firmware Mf653cdw Firmware Mf455dw Firmware

Description

Invalid free in CPCA file deletion processing on Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code. *: Satera LBP670C Series/Satera MF750C Series firmware v06.02 and earlier sold in Japan.Color imageCLASS LBP630C/Color imageCLASS MF650C Series/imageCLASS LBP230 Series/imageCLASS X LBP1238 II/imageCLASS MF450 Series/imageCLASS X MF1238 II/imageCLASS X MF1643i II/imageCLASS X MF1643iF II firmware v06.02 and earlier sold in US.i-SENSYS LBP630C Series/i-SENSYS MF650C Series/i-SENSYS LBP230 Series/1238P II/1238Pr II/i-SENSYS MF450 Series/i-SENSYS MF550 Series/1238i II/1238iF II/imageRUNNER 1643i II/imageRUNNER 1643iF II firmware v06.02 and earlier sold in Europe.

Analysis

Canon printers contain an invalid free vulnerability in CPCA file deletion processing that allows network-based attackers to execute arbitrary code or crash the device.

Technical Context

The CPCA (Common Peripheral Controlling Architecture) file deletion handler in Canon printers improperly frees memory (CWE-763), allowing an attacker to trigger a use-after-free condition by manipulating file deletion sequences.

Affected Products

['Canon Small Office Multifunction Printers', 'Canon Laser Printers']

Remediation

Apply Canon firmware updates. Restrict CPCA protocol access via network ACLs.

Priority Score

49
Low Medium High Critical
KEV: 0
EPSS: +0.1
CVSS: +49
POC: 0

Share

CVE-2025-14233 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy