SB2026061742 - Multiple vulnerabilities in cups

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026061742

SB2026061742 - Multiple vulnerabilities in cups

Published: June 17, 2026 Updated: October 12, 2026

Security Bulletin ID SB2026061742
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 18
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

Medium 6% Low 94%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 18 vulnerabilities.


1) NULL pointer dereference (CVE-ID: CVE-2026-107888)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local privileged user to cause a scheduler-wide denial of service.

The vulnerability exists due to a null pointer dereference in cupsdCheckJobs() when processing a held-on-create job whose temporary printer has been automatically deleted. A local privileged user can create a temporary printer, enable job acceptance and holding of new jobs, and submit a job while its device probe is pending to cause a scheduler-wide denial of service.

The demonstrated sequence requires access to the local CUPS Unix domain socket. A failed device probe makes the temporary printer immediately eligible for automatic removal.


2) Out-of-bounds read (CVE-ID: CVE-2026-87875)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read caused by a missing source-length bound in cupsUTF32ToUTF8() in cups/transcode.c when converting SNMP supply descriptions reported as UCS-4 or UTF-32 during printer supply-level polling. A remote attacker can send specially crafted SNMP responses from a malicious or compromised printer on the local network to disclose sensitive information.

On LP64 platforms, cups_utf32_t is an 8-byte unsigned long, widening the possible overread because each low-codepoint word consumes eight source bytes but only one byte of the output budget.


3) Use-after-free (CVE-ID: N/A)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the set_job_attrs function in cupsd when handling Set-Job-Attributes requests that replace job-printer-state-message or job-printer-state-reasons attributes without invalidating cached pointers. A local user can send a specially crafted request to overwrite these attributes and trigger subsequent access to freed memory to cause a denial of service.

Exploitation requires ownership of a print job in a state at or below STOPPED. Such a job can be created using Print-Job or Create-Job.


4) Use-after-free (CVE-ID: N/A)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the cupsd scheduler's handling of job->filetypes when processing held print jobs that reference printer-private MIME types after the associated temporary queue is deleted. A local user can create a temporary printer queue and submit a held print job referencing its private document format to trigger a crash and cause a denial of service.

Exploitation requires an accepting raw or remote queue configured by an administrator. Creating the temporary queue requires access to the scheduler through an AF_LOCAL connection.


5) Double free (CVE-ID: CVE-2026-107886)

CWE-ID: CWE-415 - Double Free

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to a double free in the cupsd class-management functions add_class() and cupsdDeletePrinter() when processing class modification and deletion requests. A local privileged user can modify an existing populated class with an invalid member URI and then delete the class to cause a denial of service.

Exploitation requires an existing printer queue to serve as the initial valid class member.


6) Input validation error (CVE-ID: N/A)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a local user to forge persistent print-job status and audit metadata.

The vulnerability exists due to improper input validation in the read-only IPP attribute filter in add_job() when processing duplicate client-supplied job attributes. A local user can submit a Print-Job or Create-Job request containing duplicate read-only attributes to forge persistent print-job status and audit metadata.

The surviving client-supplied attributes precede scheduler-generated values and are returned to all clients through first-match attribute lookups. This exploitation path is reachable in the default configuration.


7) Out-of-bounds read (CVE-ID: N/A)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to cause a persistent denial of service.

The vulnerability exists due to an out-of-bounds read in cupsdLogJob() when logging a persisted job with an out-of-range job-state value. A local user can submit a Print-Job or Create-Job request containing duplicate job-state attributes to cause a persistent denial of service.

Exploitation requires an existing print queue and a systemd-journal build configured with ErrorLog syslog or PageLog syslog. The crash is triggered when the scheduler next reloads or restarts.


8) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: N/A)

CWE-ID: CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a local privileged user to modify system directory ownership and permissions.

The vulnerability exists due to a time-of-check time-of-use race condition in cupsdCheckPermissions() in scheduler/conf.c when checking and repairing directory permissions. A local privileged user can replace CacheDir/rss with a symbolic link between the initial lstat() check and subsequent chown() or chmod() operations to modify system directory ownership and permissions.

Exploitation requires execution as the lp user and CUPS administrator access to trigger the permission check. The directory containing CacheDir/rss must be group-writable.


9) NULL pointer dereference (CVE-ID: CVE-2026-107890)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in cupsd job attribute processing when handling job submission requests containing repeated IPP group tags. A local user can submit a crafted Print-Job request to crash the scheduler and cause a denial of service.

The demonstrated exploitation requires an existing queue that accepts the supplied document format and is enabled to start printing. The crash interrupts service for all printers managed by the affected cupsd process.


10) Improper Neutralization of Special Elements in Output Used by a Downstream Component (CVE-ID: CVE-2026-55453)

CWE-ID: CWE-74 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to improper neutralization of special elements in output used by a downstream component in the CUPS ipp backend status reporting path and scheduler PPD update handling when processing text printer-status attributes from a remote IPP printer. A remote attacker can return a crafted printer-status attribute containing injected newline characters and a forged PPD status line to execute arbitrary code.

Successful exploitation requires a CUPS queue that points to an attacker-controlled or compromised IPP printer, a Foomatic-backed PPD or filter profile that invokes foomatic-rip, and a later print job that uses the modified PPD. The demonstrated code execution occurs as user lp.


11) CRLF injection (CVE-ID: N/A)

CWE-ID: CWE-93 - Improper Neutralization of CRLF Sequences ('CRLF Injection')

CVSSv4: 5.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to control a print queue's filter selection and cause a denial of service.

The vulnerability exists due to improper neutralization of CRLF sequences in the scheduler's PPD update mechanism when validating and persisting keyword values from scheduler PPD status records. A remote user can supply an allowed PPD keyword whose value contains a carriage return followed by a cupsFilter2 directive to control a print queue's filter selection and cause a denial of service.

The demonstrated remote chain requires access from the adjacent network and permission to submit jobs to a shared legacy PostScript/PPD queue through a print path reaching pstops. The injected directive is used when a subsequent job is processed.


12) CRLF injection (CVE-ID: N/A)

CWE-ID: CWE-93 - Improper Neutralization of CRLF Sequences ('CRLF Injection')

CVSSv4: 5.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to inject scheduler status records and modify a print queue's PPD.

The vulnerability exists due to improper neutralization of CRLF sequences in scheduler/job.c::get_options() and the filter option parsing path when converting IPP job attributes into textual filter options. A remote user can submit a crafted binary IPP Print-Job request containing a malformed attribute name to inject scheduler status records and modify a print queue's PPD.

Exploitation requires access from the adjacent network, permission to submit jobs to a shared legacy PostScript/PPD queue, and a print path reaching the pstops filter.


13) Input validation error (CVE-ID: N/A)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 1 [CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:A/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to modify printer queue configuration and disrupt printing.

The vulnerability exists due to improper input validation in the _ppdCreateFromIPP2() function in cups/ppd-cache.c when processing job-presets-supported collection member values from a printer response during driverless queue creation. A remote user can supply a crafted Get-Printer-Attributes response containing unsanitized quotation marks and line breaks to modify printer queue configuration and disrupt printing.

Exploitation requires user interaction to create the queue and control over the printer response, either through a malicious endpoint or a network intermediary. Queue creation requires membership in SystemGroup, which defaults to root and lpadmin. Temporary queues created through IPP_OP_CUPS_CREATE_LOCAL_PRINTER are not affected.


14) Argument injection (CVE-ID: CVE-2026-105326)

CWE-ID: CWE-88 - Argument Injection or Modification

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a local user to execute arbitrary code with the privileges of the filter user (lp).

The vulnerability exists due to argument injection in the mailto notifier's pipe_sendmail function in notifier/mailto.c when passing subscription recipient addresses to sendmail. A local user can create a printer subscription with a crafted notify-recipient-uri that causes sendmail to load an attacker-controlled configuration file to execute arbitrary code with the privileges of the filter user (lp).

Exploitation requires traditional sendmail with support for the -C option and a subscribed event to trigger notification delivery.


15) Improper Handling of Case Sensitivity (CVE-ID: CVE-2026-87876)

CWE-ID: CWE-178 - Improper Handling of Case Sensitivity

CVSSv4: 2.4 [CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to influence whether private job or subscription attributes are filtered.

The vulnerability exists due to improper handling of case sensitivity in scheduler/policy.c:cupsdGetPrivateAttrs() when processing IPP requests for job or subscription attributes. A remote user can submit a request containing a case-variant username to influence whether private job or subscription attributes are filtered.

JobPrivateAccess or SubscriptionPrivateAccess must include @OWNER or an explicit username. The supplied CVSS assessment requires adjacent-network access and user interaction. The advisory does not establish a distinct security boundary bypass beyond the documented request-supplied username trust model.


16) Path traversal (CVE-ID: CVE-2026-61702)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to path traversal in CUPS scheduler banner handling, root-side copy_banner() path construction when processing a print job with a crafted attributes-natural-language value during banner generation. A remote attacker can submit a specially crafted print job to disclose sensitive information.

Exploitation requires a banner-capable local queue processing job-sheets=standard,none, and the disclosed data is limited to files readable within the CUPS victim environment.


17) Link following (CVE-ID: CVE-2026-55480)

CWE-ID: CWE-59 - Improper Link Resolution Before File Access ('Link Following')

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local privileged user to overwrite arbitrary root-owned files and escalate privileges.

The vulnerability exists due to improper link resolution before file access in copy_model() in scheduler/ipp.c when creating a predictable temporary PPD file in a group-writable temporary directory. A local privileged user can pre-create a symlink at the predicted tempfile path to overwrite arbitrary root-owned files and escalate privileges.

The issue depends on a predictable tempfile name derived from the sequential client connection identifier, and exploitation targets the add or modify printer code path.


18) CRLF injection (CVE-ID: CVE-2026-55467)

CWE-ID: CWE-93 - Improper Neutralization of CRLF Sequences ('CRLF Injection')

CVSSv4: 7.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to improper neutralization of CRLF sequences in cupsdCreateJob option-string builder in scheduler/job.c when processing fax queue job attributes from the destination-uris collection. A remote user can submit a crafted print job with malicious destination-uri or pre-dial-string values to execute arbitrary code.

Exploitation requires a configured FAX-type queue. Where the downstream fax filter does not pass these values into a shell or modem command context, the realized impact is limited to injection into the filter option stream.


Remediation

Install update from vendor's website.

References