SB2026101237 - Multiple vulnerabilities in cups

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026101237

SB2026101237 - Multiple vulnerabilities in cups

Published: October 12, 2026

Security Bulletin ID SB2026101237
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 3
Exploitation vector Adjecent network
Highest impact Partial DoS

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 3 vulnerabilities.


1) NULL pointer dereference (CVE-ID: CVE-2026-107655)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in cupsdContinueJob() when starting print jobs containing embedded job-ticket comments. A local user can submit a crafted PostScript or PDF document containing the comment %cupsJobTicket: attributes-natural-language=xx to cause a denial of service.

Exploitation requires permission to submit jobs to an existing printer queue. The crash occurs before a document filter or backend is spawned.


2) Resource exhaustion (CVE-ID: CVE-2026-107885)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a local user to cause a denial of service by preventing new print job submissions.

The vulnerability exists due to improper job-specific handling of submission timeouts in cupsdCheckJobs() in scheduler/job.c when processing an incomplete Send-Document request. A local user can keep the incomplete request connection open and repeatedly issue Create-Job requests, causing unrelated pending jobs to accumulate until MaxJobs is reached, to cause a denial of service.

Exploitation requires access to the IPP service permitted by the configured host ACL and a queue accepting job creation.


3) Stack-based buffer overflow (CVE-ID: N/A)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 2 [CVSS:4.0/AV:A/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote privileged user to cause a denial of service.

The vulnerability exists due to a stack-based buffer overflow in backend_init_supplies() in backend/snmp-supplies.c when assembling marker-names from SNMP supply descriptions without checking the remaining buffer capacity. A remote privileged user can supply specially crafted SNMP responses to cause a denial of service.

Exploitation requires SNMP supply polling to be enabled. Third-party injection requires the ability to observe and inject SNMP traffic, but does not require controlling or spoofing the configured printer because response sender addresses are not validated. Persistent failure requires a writable and reusable SNMP cache.


Remediation

Install update from vendor's website.

References