HP implemented a JPEG parser for handling colorful fax documents in their all-in-one printers.
The JPEG parser has a Buffer-Overflow over the globals when handling the COM (String Comment) JPEG marker, resulting in a remote code execution.

Technical Details

  1. The length field is a controlled 2 byte field
  2. The length is used (without checks) to read data from our controlled file, and into a global struct of size ~2100 bytes