Loading story…
CVE-2024-0244 is an unauthenticated heap-based buffer overflow in the Canon MF753Cdw's fax-job processing that can be triggered by sending a malformed binary fax job to the /wsd/print HTTP endpoint. The flaw copies an attacker-supplied destination fax-number length into the phone_number array without bounds checking, corrupting an adjacent object pointer that is subsequently passed to free(), yielding an arbitrary-free primitive.
Researchers demonstrated remote code execution by chaining the flaw with Canon's unauthenticated BJNP protocol, which can place attacker-controlled data at predictable memory addresses. An attacker can place a fake heap chunk in a BJNP buffer, have it reused as a legitimate object, overwrite its function pointer, and redirect execution to shellcode stored in a second BJNP buffer; the device's dynamic memory is reported to be RWX. The Pwn2Own Toronto 2023 demonstration used the resulting code execution to retrieve and display an image on the printer screen.
See affected versions and whether adversaries are exploiting it.
1 event from the most recent confirmed update back to the earliest known activity.
Researchers used the unauthenticated heap-based fax-processing overflow in the Canon MF753Cdw during Pwn2Own Toronto 2023 research. The exploit combined an arbitrary-free primitive with attacker-controlled BJNP buffers to overwrite a function pointer and execute shellcode on the printer.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcethezdi.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**Canon** disclosed patches for multiple **remote code execution** vulnerabilities affecting the *imageCLASS MF654Cdw* printer, following coordinated publication through **Zero Day Initiative** advisories tied to *Pwn2Own*. The flaws allow **network-adjacent, unauthenticated attackers** to execute arbitrary code in the context of the device, and each advisory assigns a **CVSS 8.8** severity rating. The vulnerabilities were reported in November 2025 and publicly released in March 2026, with Canon directing customers to its product security guidance for updates. The disclosed issues affect several distinct attack surfaces on the printer. **CVE-2025-14232** is a stack-based buffer overflow in **XPS** file parsing, **CVE-2025-14235** is an out-of-bounds write in **TrueType font** parsing, **CVE-2025-14234** is a heap-based buffer overflow triggered by a crafted font in a **PJCC** request within the **CADM** service listening on `TCP/9013`, and **CVE-2025-14236** is a stack-based buffer overflow in the `dtdc_addr_importSub` method. Together, the advisories indicate that malicious print content or protocol requests could be used to compromise exposed devices, reinforcing the need to patch internet-reachable and internally accessible printers promptly.
Jun 29, 2026
Researchers disclosed a three-step exploit chain in the **Brother MFC-J1010DW** printer that can lead to unauthenticated remote code execution and full device compromise on firmware `1.18` and earlier. The chain starts with unauthenticated **SNMP** access that exposes the printer’s serial number, followed by a default administrator password derivation scheme based on that serial number, and an unauthenticated firmware rollback feature that allows the device to be downgraded to a vulnerable version. After reversing the printer firmware, the researchers identified a stack-based buffer overflow in HTTP `Referer` header handling within the `decode_csrftoken` path and used it to achieve arbitrary code execution, demonstrating the attack by making the printer display **"STAR LABS!"** on its LCD. The report recommends upgrading to firmware `1.19` or later, disabling SNMP where it is not needed, changing default credentials, segmenting printers from other network assets, and strengthening vendor protections such as authenticated updates, rollback prevention, and safer coding practices.
Jun 29, 2026
A critical vulnerability in HP Linux Imaging and Printing (**HPLIP**), tracked as **`CVE-2026-14544`**, allows unauthenticated remote attackers to trigger arbitrary code execution, privilege escalation, denial of service, or memory corruption by sending specially crafted print data to the **`hpcups`** processing path. The bug is an integer overflow (**`CWE-190`**) and has been rated **CVSS 9.8**. Researchers and downstream reporting described it as an incomplete fix for the earlier **`CVE-2026-8631`**, meaning prior remediation did not fully eliminate the underlying issue. The flaw affects HPLIP versions prior to **`3.26.4`** and has broad exposure because HPLIP is widely deployed on Linux systems that support HP printers. Upstream reportedly fixed the issue in **`3.26.4`**, while Linux vendors including Ubuntu, Debian, SUSE/openSUSE, Oracle Linux, and Red Hat have identified affected products or begun issuing and backporting updates; Red Hat said **RHEL 8, 9, and 10** are affected, while **RHEL 6 and 7** are not. Until patches are fully available across distributions, defenders have been urged to apply vendor security updates as they are released, restrict network exposure to printing services such as CUPS, isolate print servers, monitor print activity, and remove HPLIP where it is not required.
Jul 9, 2026