CVE-2021-38085

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

The Canon TR150 print driver through 3.71.2.10 is vulnerable to a privilege escalation issue. During the add printer process, a local attacker can overwrite CNMurGE.dll and, if timed properly, the overwritten DLL will be loaded into a SYSTEM process resulting in escalation of privileges. This occurs because the driver drops a world-writable DLL into a CanonBJ %PROGRAMDATA% location that gets loaded by printisolationhost (a system process).

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-732

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.com/files/163795/Canon-TR150-Driver-3.71.2.10-Privilege-Escalation.htmlExploit, Third Party Advisory, VDB Entry
https://defcon.org/html/defcon-29/dc-29-speakers.html#bainesThird Party Advisory
https://raw.githubusercontent.com/jacob-baines/vuln_disclosure/main/vuln_2021_03.txtThird Party Advisory
https://www.youtube.com/watch?v=vdesswZYz-8Exploit, Third Party Advisory
http://packetstormsecurity.com/files/163795/Canon-TR150-Driver-3.71.2.10-Privilege-Escalation.htmlExploit, Third Party Advisory, VDB Entry
https://defcon.org/html/defcon-29/dc-29-speakers.html#bainesThird Party Advisory
https://raw.githubusercontent.com/jacob-baines/vuln_disclosure/main/vuln_2021_03.txtThird Party Advisory
https://www.youtube.com/watch?v=vdesswZYz-8Exploit, Third Party Advisory

Timeline

Published: Aug 11, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-380867.8Acronis Cyber Protect 15 for Windows prior to build 27009 and Acronis Agent for Windows prior to build 26226 allowed local privilege escalat CVE-2021-380876.1Reflected cross-site scripting (XSS) was possible on the login page in Acronis Cyber Protect 15 prior to build 27009.CVE-2021-380887.8Acronis Cyber Protect 15 for Windows prior to build 27009 allowed local privilege escalation via binary hijacking.CVE-2021-38097.8Potential security vulnerabilities have been identified in the BIOS (UEFI Firmware) for certain HP PC products, which might allow arbitrary CVE-2021-380908.8Integer Overflow vulnerability in function filter16_roberts in libavfilter/vf_convolution.c in Ffmpeg 4.2.1, allows attackers to cause a Den CVE-2021-380918.8Integer Overflow vulnerability in function filter16_sobel in libavfilter/vf_convolution.c in Ffmpeg 4.2.1, allows attackers to cause a Denia CVE-2021-380928.8Integer Overflow vulnerability in function filter_prewitt in libavfilter/vf_convolution.c in Ffmpeg 4.2.1, allows attackers to cause a Denia CVE-2021-380938.8Integer Overflow vulnerability in function filter_robert in libavfilter/vf_convolution.c in Ffmpeg 4.2.1, allows attackers to cause a Denial CVE-2021-380948.8Integer Overflow vulnerability in function filter_sobel in libavfilter/vf_convolution.c in Ffmpeg 4.2.1, allows attackers to cause a Denial CVE-2021-380957.5The REST API in Planview Spigit 4.5.3 allows remote unauthenticated attackers to query sensitive user accounts data, as demonstrated by an a CVE-2021-380967.8Coreip.dll in Corel PDF Fusion 2.6.2.0 is affected by an Out-of-bounds Write vulnerability when parsing a crafted file. An unauthenticated a CVE-2021-380977.8Corel PDF Fusion 2.6.2.0 is affected by an Out-of-bounds Write vulnerability when parsing a crafted file. An unauthenticated attacker could