CVE-2024-0244 – A heap buffer overflow in the Canon MF753Cdw printer
ZDI details CVE-2024-0244, an unauthenticated heap overflow in the Canon MF753Cdw exploited at Pwn2Own.
A Zero Day Initiative retrospective describes CVE-2024-0244, an unauthenticated heap-based buffer overflow in the Canon MF753Cdw printer that leads to an arbitrary free(). The flaw is in parsing a binary fax job sent over SOAP to the printer's print service, where an unchecked destination-number length overflows a heap object. The author, who previously targeted the similar MF743Cdw, outlines contest exploitation using Canon's BJNP protocol to place shellcode in RWX memory, but says the precise root cause was never identified. The issue was prepared for Pwn2Own Toronto 2023 and is not described as ongoing exploitation.
- Unauthenticated heap overflow in MF753Cdw fax parsing yields an arbitrary free.
- A crafted fax-number length overwrites a heap object pointer later freed.
- BJNP requests were used to stage shellcode at a fixed executable address.
- The work targeted Pwn2Own Toronto 2023; the exact root cause stayed unidentified.
- CVEs
- CVE-2024-0244
- Vendors
- Canon
- Products
- Canon MF753CdwCanon MF743Cdw
- Organizations
- Zero Day Initiative
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2024-0244 | Buffer overflow in CPCA PCFAX number process of Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to… | 9.8 | 1% |
From the original article
7 min read at thezdi.com
With Pwn2Own Ireland 2026 coming up, I wanted to share an unreleased blog post from my time as a Pwn2Own contestant. This post covers the discovery and exploitation of CVE-2024-0244, which is an unauthenticated heap-based buffer overflow leading to an arbitrary free() in the Canon MF753Cdw printer featured in Pwn2Own Toronto 2023.
By Connor Ford · thezdi.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.