ZDI has detailed CVE-2024-0244, an unauthenticated heap-based buffer overflow in the Canon MF753Cdw printer. The flaw lies in fax handling: Windows fax-driver traffic sends SOAP messages, including a binary fax-job payload, to the printer’s `/wsd/print` HTTP endpoint. That payload contains length fields for strings such as the destination fax number. Supplying an oversized value, such as `0xff`, caused the printer to crash and reboot.
Researchers found that the unchecked copy could overflow a heap object and overwrite a pointer subsequently passed to `free()`, giving an attacker control of the pointer and enabling an arbitrary free. ZDI says the precise root cause was not identified, although its analysis indicates that up to 255 bytes could be copied into a 48-byte phone-number field.
The research was conducted in the context of Pwn2Own Toronto 2023. ZDI described several possible exploitation routes before settling on one using Canon’s unauthenticated BJNP protocol, which handles discovery and print jobs. BJNP requests are stored at predictable fixed addresses, accept arbitrary payload bytes and can therefore hold shellcode.
By placing a fake heap chunk and shellcode in separate BJNP buffers, triggering the arbitrary free and arranging a later allocation, the researchers could overwrite a function pointer to redirect execution to the shellcode. A demonstration payload connected back to the attacker, retrieved an image and displayed it on the printer, including a DOOM image.
The article does not provide affected firmware versions, a patch status or mitigation instructions, and notes that techniques described may not apply to newer Canon devices.