CRLF injection in cups - CVE-2026-55467

Detailed vulnerability description

The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to improper neutralization of CRLF sequences in cupsdCreateJob option-string builder in scheduler/job.c when processing fax queue job attributes from the destination-uris collection. A remote user can submit a crafted print job with malicious destination-uri or pre-dial-string values to execute arbitrary code.

Exploitation requires a configured FAX-type queue. Where the downstream fax filter does not pass these values into a shell or modem command context, the realized impact is limited to injection into the filter option stream.

How to mitigate CVE-2026-55467

Sources

• https://github.com/OpenPrinting/cups/security/advisories/GHSA-69qc-prxg-h2c7
• https://github.com/OpenPrinting/cups