Integer underflow in cups - CVE-2026-39314

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU125822

Integer underflow in cups - CVE-2026-39314

Published: April 11, 2026 / Updated: April 17, 2026


Vulnerability identifier: #VU125822
CSH Severity: Low
CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-39314
CWE-ID: CWE-191
Exploitation vector: Local access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to integer underflow in _ppdCreateFromIPP() in cups/ppd-cache.c when processing a negative job-password-supported IPP attribute. A local user can supply a crafted IPP response to cause a denial of service.

Exploitation involves creating a local printer that points to a fake IPP printer on localhost, causing the cupsd root process to crash.


Affected software

cups
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Micro
SUSE Linux Enterprise Micro for Rancher
SUSE Linux Micro
Basesystem Module
Desktop Applications Module
Development Tools Module
openEuler
Ubuntu
Anolis OS
Fedora
libcups2-32bit
libcupsimage2-debuginfo
cups-debuginfo
libcupsppdc1-debuginfo
cups-debugsource
libcupsmime1-debuginfo
libcups2
cups
libcupsmime1
cups-client-debuginfo
libcupscgi1-debuginfo
cups-devel
libcupsimage2
libcupscgi1
cups-config
cups-client
libcups2-debuginfo
cups-ddk
cups-ddk-debuginfo
libcups2-32bit-debuginfo
libcupsppdc1
cups-ipptool
cups-libs
cups-lpd
cups-printerapp
cups-filesystem
cups-help
cups (Ubuntu package)
cups-doc

How to mitigate CVE-2026-39314

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

cups - update to 2.4.17
libcups2-32bit - update to 2.2.7-150000.3.93.1
libcupsimage2-debuginfo - update to 2.2.7-150000.3.93.1
cups-debuginfo - update to 2.2.7-150000.3.93.1
libcupsppdc1-debuginfo - update to 2.2.7-150000.3.93.1
cups-debugsource - addressed in versions 2.2.7-150000.3.93.1, 2.4.19-1.1
libcupsmime1-debuginfo - update to 2.2.7-150000.3.93.1
libcups2 - addressed in versions 2.2.7-150000.3.93.1, 2.4.19-1.1
cups - update to 2.2.7-150000.3.93.1
libcupsmime1 - update to 2.2.7-150000.3.93.1
cups-client-debuginfo - update to 2.2.7-150000.3.93.1
libcupscgi1-debuginfo - update to 2.2.7-150000.3.93.1
cups-devel - update to 2.2.7-150000.3.93.1
libcupsimage2 - update to 2.2.7-150000.3.93.1
libcupscgi1 - update to 2.2.7-150000.3.93.1
cups-config - addressed in versions 2.2.7-150000.3.93.1, 2.4.19-1.1
cups-client - update to 2.2.7-150000.3.93.1
libcups2-debuginfo - addressed in versions 2.2.7-150000.3.93.1, 2.4.19-1.1
cups-ddk - update to 2.2.7-150000.3.93.1
cups-ddk-debuginfo - update to 2.2.7-150000.3.93.1
libcups2-32bit-debuginfo - update to 2.2.7-150000.3.93.1
libcupsppdc1 - update to 2.2.7-150000.3.93.1
cups - addressed in versions 2.4.0-19, 2.4.7-12, 2.4.7-13, 2.4.7-14
cups-client - addressed in versions 2.4.0-19, 2.4.7-12, 2.4.7-13, 2.4.7-14
cups-debugsource - addressed in versions 2.4.0-19, 2.4.7-12, 2.4.7-13, 2.4.7-14
cups-devel - addressed in versions 2.4.0-19, 2.4.7-12, 2.4.7-13, 2.4.7-14
cups-ipptool - addressed in versions 2.4.0-19, 2.4.7-12, 2.4.7-13, 2.4.7-14
cups-libs - addressed in versions 2.4.0-19, 2.4.7-12, 2.4.7-13, 2.4.7-14
cups-lpd - addressed in versions 2.4.0-19, 2.4.7-12, 2.4.7-13, 2.4.7-14
cups-printerapp - addressed in versions 2.4.0-19, 2.4.7-12, 2.4.7-13, 2.4.7-14
cups-filesystem - addressed in versions 2.4.0-19, 2.4.7-12, 2.4.7-13, 2.4.7-14
cups-help - addressed in versions 2.4.0-19, 2.4.7-12, 2.4.7-13, 2.4.7-14
cups-debuginfo - addressed in versions 2.4.0-19, 2.4.7-12, 2.4.7-13, 2.4.7-14
cups (Ubuntu package) - addressed in versions 2.4.1op1-1ubuntu4.20, 2.4.1op1-1ubuntu4.21, 2.4.7-1.2ubuntu7.13, 2.4.7-1.2ubuntu7.14, 2.4.12-0ubuntu3.9, 2.4.12-0ubuntu3.10, 2.4.16-1ubuntu1.2, 2.4.16-1ubuntu1.3
cups-doc - update to 2.4.10-7
cups - update to 2.4.10-7
cups-client - update to 2.4.10-7
cups-devel - update to 2.4.10-7
cups-ipptool - update to 2.4.10-7
cups-filesystem - update to 2.4.10-7
cups-printerapp - update to 2.4.10-7
cups-lpd - update to 2.4.10-7
cups-libs - update to 2.4.10-7
cups - addressed in versions 2.4.17-1.fc42, 2.4.17-1.fc43, 2.4.17-1.fc44, 2.4.17-1.fc45

External References

Related Security Bulletins