# CVE-2024-0244 – Unauthenticated Heap Buffer Overflow in Canon MF753Cdw Printer (Fax Job Handling, /wsd/print)

> CVE-2024-0244 is an unauthenticated heap-based buffer overflow in the fax job handling (CPCA PCFAX number process) of Canon MF750C-series printers including the imageCLASS MF753Cdw. A fax destination number is copied into a fixed-size heap field without bounds checking, leading to an arbitrary free() and, as demonstrated for Pwn2Own, remote code execution.

- **Published:** 2026-11-11T10:14:22Z
- **Last reviewed:** 2026-11-11T10:14:22Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5751
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5751.png
- **ID:** TL-2026-5751
- **Severity:** HIGH (CVSS 9.8)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 (1 shown free below) · **IOCs:** 8
- **CVEs:** CVE-2024-0244, CVE-2023-6234

## Description

CVE-2024-0244 affects the fax job handling of Canon laser and small-office multifunction printers, including the Color imageCLASS MF753Cdw (featured at Pwn2Own Toronto 2023). NVD describes it as a buffer overflow in the CPCA PCFAX number process (CWE-787) that lets an attacker on the same network segment make the device unresponsive or execute arbitrary code. NVD and Canon score it CVSS 3.1 9.8; ZDI advisory ZDI-24-095 (ZDI-CAN-22658) scores it 8.8 with an adjacent-network vector. ZDI credits Connor Ford (@ByteInsight) of Nettitude, who reported it to Canon on 2023-12-11; coordinated public release was 2024-02-06.

A ZDI blog post by Connor Ford, published 2026-09-23, gives the technical detail. The printer's fax driver sends several SOAP messages to the /wsd/print HTTP endpoint to start a fax job. One of them is the only message in the flow carrying a binary payload. That payload holds the destination fax details, the file and filename, the Windows username and machine name, and a few hundred bytes of unknown data. Most strings in it are preceded by a length byte. Setting the destination number's length byte to 0xff crashed the fax task and rebooted the printer. Instrumenting free() showed the crash was caused by a fully attacker-controlled pointer being passed to free(). The destination number is copied into a fixed-size phone_number array using the attacker-supplied length with no bounds check; the overflow reaches an adjacent pointer member that is later freed. The author did not identify the exact root-cause object.

The author's Pwn2Own exploit chain uses Canon's proprietary BJNP discovery/print protocol. Unauthenticated clients can send BJNP requests that are stored at known fixed addresses and accept arbitrary bytes in the body. BJNP buffers are used to stage a fake heap chunk and shellcode at known addresses. The arbitrary free() places the fake chunk on the free list, a legitimate allocation then lands on it, and a later BJNP session overwrites a function pointer in that object to point at the shellcode. All dynamic memory on the device is RWX. The demonstration shellcode fetched an image from a remote machine and displayed it on the printer screen (DOOM). The post notes that newer Canon devices have a few security mitigations that may make these techniques inapplicable.

The sources do not report in-the-wild exploitation (CISA SSVC: exploitation none, automatable no, technical impact total), a public weaponized PoC, IOCs or actor attribution. Canon states the issue is resolved for the affected models via firmware update; the NVD configuration covers firmware v03.07 and earlier.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1071 Application Layer Protocol

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**CVE-2024-0244 Canon MFP — Printer-Originated Internet Egress (Shellcode Payload Fetch / C2)** (`TL-2026-5751-SPL-003`)

Detects Canon printers initiating connections to non-private destinations. The Pwn2Own shellcode for CVE-2024-0244 fetched an image from a remote machine over the network (ingress tool transfer), and any post-exploitation implant on the MFP would call out over HTTP(S). Printers normally only answer print/scan requests and talk to a few internal services.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1105, T1071, T1071.001
- **Data sources:** zeek:conn (index=zeek) + tl_printer_assets lookup, NGFW flow logs (CommonSecurityLog) + PrinterAssets watchlist
- **Severity:** high
- **Confidence:** medium

### Splunk SPL

```spl
index=zeek sourcetype="bro:conn:json" earliest=-24h
| rename id.orig_h AS src_ip, id.resp_h AS dest_ip, id.resp_p AS dest_port
| lookup tl_printer_assets ip AS src_ip OUTPUT asset_role model
| where asset_role="printer"
| where NOT (cidrmatch("10.0.0.0/8",dest_ip) OR cidrmatch("172.16.0.0/12",dest_ip) OR cidrmatch("192.168.0.0/16",dest_ip) OR cidrmatch("169.254.0.0/16",dest_ip))
| stats count AS conns dc(dest_ip) AS dests values(dest_port) AS ports sum(orig_bytes) AS bytes_out sum(resp_bytes) AS bytes_in BY src_ip, model, dest_ip
| eval cve="CVE-2024-0244", note="Printer egress to non-private host: possible payload fetch or C2 callback"
| table src_ip model dest_ip ports conns bytes_out bytes_in cve note
```

### Microsoft KQL

```kql
let Printers = _GetWatchlist('PrinterAssets') | project SourceIP = tostring(IPAddress), Model;
CommonSecurityLog
| where TimeGenerated > ago(24h)
| where not(ipv4_is_private(DestinationIP))
| join kind=inner Printers on SourceIP
| summarize Conns=count(), Ports=make_set(DestinationPort), BytesOut=sum(SentBytes), BytesIn=sum(ReceivedBytes) by SourceIP, Model, DestinationIP
| project SourceIP, Model, DestinationIP, Ports, Conns, BytesOut, BytesIn
```

### Sigma

```yaml
title: Canon Printer Outbound Web Connection to Non-Private Address
id: 7b1e5c52-3a0d-4f0e-9a51-575100000003
status: experimental
description: Detects a printer-VLAN host initiating web connections to non-private addresses, consistent with CVE-2024-0244 post-exploitation payload fetch or C2. The source CIDR is an example printer VLAN and must be edited per environment.
references:
    - https://www.zerodayinitiative.com/advisories/ZDI-24-095
    - https://www.thezdi.com/blog/2026/9/23/cve-2024-0244-a-heap-buffer-overflow-in-the-canon-mf753cdw-printer
author: Threadlinqs Team
date: 2026-11-11
tags:
    - attack.command-and-control
    - attack.t1071.001
    - attack.t1105
    - cve.2024-0244
logsource:
    category: firewall
detection:
    selection:
        src_ip|cidr: '10.99.0.0/24'
        dst_port:
            - 80
            - 443
            - 8080
            - 8443
    filter_internal:
        dst_ip|cidr:
            - '10.0.0.0/8'
            - '172.16.0.0/12'
            - '192.168.0.0/16'
            - '169.254.0.0/16'
    condition: selection and not filter_internal
falsepositives:
    - Printer cloud services such as vendor firmware checks or remote-support features
    - NTP or DNS to public resolvers if not proxied
level: medium

```

**Known false positives:**

- Printer cloud services such as vendor firmware checks, ePrint or remote-support features
- NTP or DNS to public resolvers when not proxied

**Tuning notes:** Create the tl_printer_assets lookup (ip, asset_role, model) and the PrinterAssets Sentinel watchlist from your CMDB. The Sigma flavour uses the example printer VLAN 10.99.0.0/24 and must be edited to your printer subnets. Allowlist Canon update and cloud-service destinations.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- CVE-2024-0244 Canon MFP — First-Seen Client Posting to [indicator] — Exploitation (locked: unlock with TL Creds)
- CVE-2024-0244 Canon MFP — [indicator] SOAP plus BJNP From Same Source — Exploit Chain (locked: unlock with TL Creds)
- CVE-2024-0244 Canon MFP — Printer-Originated Connections to Admin Protocols / Internal Fan-Out (locked: unlock with TL Creds)
- CVE-2024-0244 Canon MFP — Non-Private Source Requesting [indicator] — Exploitation (locked: unlock with TL Creds)
- Canon BJNP Ports Reachable From Non-Private Source (CVE-2024-0244 Exposure) (locked: unlock with TL Creds)
- Canon BJNP Discovery Sweep (UDP 8611) Across Multiple Hosts — Printer Reconnaissance (locked: unlock with TL Creds)
- CVE-2024-0244 Canon MFP Fax Job Overflow — Burst of SOAP POSTs to [indicator] — Exploitation (locked: unlock with TL Creds)
- CVE-2024-0244 Canon BJNP Session Burst to Printer — Exploit Staging / Post-Exploitation (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [CVE-2024-0244 – A heap buffer overflow in the Canon MF753Cdw printer (Connor Ford, ZDI)](https://www.thezdi.com/blog/2026/9/23/cve-2024-0244-a-heap-buffer-overflow-in-the-canon-mf753cdw-printer)
- [ZDI-24-095: Canon imageCLASS MF753Cdw fax job heap-based buffer overflow RCE](https://www.zerodayinitiative.com/advisories/ZDI-24-095)
- [NVD – CVE-2024-0244](https://nvd.nist.gov/vuln/detail/CVE-2024-0244)
- [Canon PSIRT CP2024-001](https://psirt.canon/advisory-information/cp2024-001/)
- [Canon Japan – Vulnerability response (240205)](https://canon.jp/support/support-info/240205vulnerability-response)
- [Canon USA – Service Notice: Buffer Overflow Vulnerability Measure for Laser Printers and Small Office MFPs](https://www.usa.canon.com/support/canon-product-advisories/Service-Notice-Regarding-Vulnerability-Measure-Against-Buffer-Overflow-for-Laser-Printers-and-Small-Office-Multifunctional-Printers)
- [Canon Europe – Product security latest news](https://www.canon-europe.com/support/product-security-latest-news/)
- [ZDI-24-562: Canon imageCLASS MF753Cdw setResource Buffer Overflow RCE (related CVE-2023-6234)](https://zerodayinitiative.com/advisories/ZDI-24-562)
- [Pwn2Own 2021 Canon imageCLASS MF644Cdw writeup (UART shell reference)](https://doar-e.github.io/blog/2022/06/11/pwn2own-2021-canon-imageclass-mf644cdw-writeup/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5751