CVE-2024-0244 – A heap buffer overflow in the Canon MF753Cdw printer

With Pwn2Own Ireland 2026 coming up, I wanted to share an unreleased blog post from my time as a Pwn2Own contestant. This post covers the discovery and exploitation of CVE-2024-0244, which is an unauthenticated heap-based buffer overflow leading to an arbitrary free() in the Canon MF753Cdw printer featured in Pwn2Own Toronto 2023.

This blog post gives an overview of the vulnerability and the exploitation techniques used.

Figure 1 - MF753Cdw printer

Figure 1 - MF753Cdw printer

Previously, I had exploited the very similarly named MF743Cdw at Pwn2Own Toronto 2022 using a classic stack buffer overflow, so I had a solid baseline understanding of this family of printers and their quirks.

Starting Point

Over the years at Pwn2Own, the Canon family of printers has been exploited many times, which means that many researchers have combed through the firmware. Lots of the more obvious vulnerabilities have been exploited (especially against the proprietary cadm service), so I decided to start vulnerability research against something a bit more obscure that hadn’t been exploited before.

This led to me exploring Canon’s drivers that interact with lesser-used services. The MF753Cdw support page offered a handful of Windows drivers with one of these being for sending faxes. This seemed obscure enough and I therefore chose it as a research target.

Faxing

After installing the fax driver in a Windows virtual machine, the usual Windows print dialog box contained a new entry for sending faxes. Before sending a fax job to the printer, the fax destination information needs to be filled out.

Figure 2 - Required fax information

Figure 2 - Required fax information

I then used Wireshark to capture the traffic once the fax job was submitted. Interestingly, the printer accepted the fax request even though no phone line was connected. Behind the scenes, the driver sends many SOAP messages to the printer to initiate the fax job before sending the actual fax payload.

With Pwn2Own Ireland 2026 coming up, I wanted to share an unreleased blog post from my time as a Pwn2Own contestant. This post covers the discovery and exploitation of CVE-2024-0244, which is an unauthenticated heap-based buffer overflow leading to an arbitrary free() in the Canon MF753Cdw printer featured in Pwn2Own Toronto 2023.

This blog post gives an overview of the vulnerability and the exploitation techniques used.

Figure 1 - MF753Cdw printer

Figure 1 - MF753Cdw printer

Previously, I had exploited the very similarly named MF743Cdw at Pwn2Own Toronto 2022 using a classic stack buffer overflow, so I had a solid baseline understanding of this family of printers and their quirks. Starting Point Over the years at Pwn2Own, the Canon family of printers has been exploited many times, which means that many researchers have combed through the firmware.

Lots of the more obvious vulnerabilities have been exploited (especially against the proprietary cadm service), so I decided to start vulnerability research against something a bit more obscure that hadn’t been exploited before. This led to me exploring Canon’s drivers that interact with lesser-used services. The MF753Cdw support page offered a handful of Windows drivers with one of these being for sending faxes.

This seemed obscure enough and I therefore chose it as a research target. Faxing After installing the fax driver in a Windows virtual machine, the usual Windows print dialog box contained a new entry for sending faxes. Before sending a fax job to the printer, the fax destination information needs to be filled out.

Figure 2 - Required fax information

I then used Wireshark to capture the traffic once the fax job was submitted.