Loading vulnerability…
CVE-2021-3438 is a high-severity local privilege escalation vulnerability in the legacy SSPORT.SYS printer driver used by numerous HP LaserJet, Samsung, and Xerox printer products. The flaw is caused by improper validation of user-supplied IOCTL input in a kernel-mode driver routine that accepts data from user mode and uses a user-controlled size parameter in a string copy operation. Specifically, the vulnerable code uses strncpy with insufficient bounds enforcement, allowing a buffer overflow in kernel space. Because the driver can be installed during printer software setup, may remain present even if installation is canceled, and is loaded by Windows at boot once installed, the vulnerable attack surface can persist on affected systems even when no printer is actively connected or configured. The issue has been reported as affecting hundreds of printer models and may also be present on systems where the driver was delivered through Windows Update.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
This repository contains a proof-of-concept (POC) local privilege escalation exploit targeting CVE-2021-3438 (HP/Samsung printer drivers) and CVE-2021-44852 (Biostar RACING GT Evo BS_RCIO64.sys driver) on Windows. The main exploit logic is implemented in 'CVE-2021-3438/exploit.c', which attempts to obtain handles to the vulnerable device drivers (SSPORT.sys and BS_RCIO64.sys), leak the kernel base address of SSPORT.sys, and write a placeholder shellcode payload to kernel memory. The exploit then triggers execution of this payload via a crafted IOCTL to the BS_RCIO64.sys driver. If successful, the exploit launches a SYSTEM-level command prompt. The payload is currently a placeholder and not a real token stealing shellcode, making this a POC rather than a fully weaponized exploit. The code is written in C and is structured as a Visual Studio project, with supporting utility files for leaking kernel addresses and string manipulation. The exploit requires local access, the presence of the vulnerable drivers, and that the NX (No-eXecute) feature is disabled on the target system.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A known HP printer privilege escalation vulnerability that threat actors attempted to exploit via Rundll32 during attacks targeting a financial institution.
A high-severity buffer overflow vulnerability in the SSPORT.SYS printer driver affecting HP, Samsung, and Xerox printers, allowing local privilege escalation to SYSTEM and kernel-mode code execution.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.