CVE-2021-38085

    Dashboard / Vulnerabilities / CVE-2021-38085

    CVE-2021-38085

    Published: 11 Aug 2021Last Modified: 10 Mar 2026

    Summary:

    Details: The Canon TR150 print driver through 3.71.2.10 is vulnerable to a privilege escalation issue. During the add printer process, a local attacker can overwrite CNMurGE.dll and, if timed properly, the overwritten DLL will be loaded into a SYSTEM process resulting in escalation of privileges. This occurs because the driver drops a world-writable DLL into a CanonBJ %PROGRAMDATA% location that gets loaded by printisolationhost (a system process).

    References: , https://defcon.org/html/defcon-29/dc-29-speakers.html#baines, https://raw.githubusercontent.com/jacob-baines/vuln_disclosure/main/vuln_2021_03.txt, http://packetstormsecurity.com/files/163795/Canon-TR150-Driver-3.71.2.10-Privilege-Escalation.html, https://www.youtube.com/watch?v=vdesswZYz-8

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2021-38085 | CVE-DB