Out-of-bounds read in cups - CVE-2026-87875

Vulnerability identifier: #VU154063

CSH Severity: Low

CVSS v4: 5.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-87875

CWE-ID: CWE-125

Exploitation vector: Adjecent network

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read caused by a missing source-length bound in cupsUTF32ToUTF8() in cups/transcode.c when converting SNMP supply descriptions reported as UCS-4 or UTF-32 during printer supply-level polling. A remote attacker can send specially crafted SNMP responses from a malicious or compromised printer on the local network to disclose sensitive information.

On LP64 platforms, cups_utf32_t is an 8-byte unsigned long, widening the possible overread because each low-codepoint word consumes eight source bytes but only one byte of the output budget.

cups
SUSE Linux Enterprise Server 12 SP5 LTSS Extended
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Micro
SUSE Linux Enterprise Micro for Rancher
Development Tools Module
Desktop Applications Module
Basesystem Module
openEuler
cups-libs-32bit
cups-devel
cups-client-debuginfo
cups-debugsource
cups
cups-libs-debuginfo
cups-libs
cups-libs-debuginfo-32bit
cups-debuginfo
cups-client
libcups2
cups-config
libcups2-debuginfo
libcupsmime1
libcupscgi1
libcupscgi1-debuginfo
libcupsimage2
libcupsppdc1-debuginfo
libcupsimage2-debuginfo
libcupsmime1-debuginfo
libcupsppdc1
libcups2-32bit-debuginfo
libcups2-32bit
cups-ddk
cups-ddk-debuginfo
cups-ipptool
cups-lpd
cups-printerapp
cups-filesystem
cups-help

Install security update from vendor's website.

cups - update to 2.4.20
cups-libs-32bit - update to 1.7.5-20.70.1
cups-devel - addressed in versions 1.7.5-20.70.1, 2.2.7-150000.3.96.1
cups-client-debuginfo - addressed in versions 1.7.5-20.70.1, 2.2.7-150000.3.96.1
cups-debugsource - addressed in versions 1.7.5-20.70.1, 2.2.7-150000.3.96.1
cups - addressed in versions 1.7.5-20.70.1, 2.2.7-150000.3.96.1
cups-libs-debuginfo - update to 1.7.5-20.70.1
cups-libs - update to 1.7.5-20.70.1
cups-libs-debuginfo-32bit - update to 1.7.5-20.70.1
cups-debuginfo - addressed in versions 1.7.5-20.70.1, 2.2.7-150000.3.96.1
cups-client - addressed in versions 1.7.5-20.70.1, 2.2.7-150000.3.96.1
libcups2 - update to 2.2.7-150000.3.96.1
cups-config - update to 2.2.7-150000.3.96.1
libcups2-debuginfo - update to 2.2.7-150000.3.96.1
libcupsmime1 - update to 2.2.7-150000.3.96.1
libcupscgi1 - update to 2.2.7-150000.3.96.1
libcupscgi1-debuginfo - update to 2.2.7-150000.3.96.1
libcupsimage2 - update to 2.2.7-150000.3.96.1
libcupsppdc1-debuginfo - update to 2.2.7-150000.3.96.1
libcupsimage2-debuginfo - update to 2.2.7-150000.3.96.1
libcupsmime1-debuginfo - update to 2.2.7-150000.3.96.1
libcupsppdc1 - update to 2.2.7-150000.3.96.1
libcups2-32bit-debuginfo - update to 2.2.7-150000.3.96.1
libcups2-32bit - update to 2.2.7-150000.3.96.1
cups-ddk - update to 2.2.7-150000.3.96.1
cups-ddk-debuginfo - update to 2.2.7-150000.3.96.1
cups-client - addressed in versions 2.4.0-22, 2.4.7-17
cups - addressed in versions 2.4.0-22, 2.4.7-17
cups-debuginfo - addressed in versions 2.4.0-22, 2.4.7-17
cups-debugsource - addressed in versions 2.4.0-22, 2.4.7-17
cups-devel - addressed in versions 2.4.0-22, 2.4.7-17
cups-ipptool - addressed in versions 2.4.0-22, 2.4.7-17
cups-libs - addressed in versions 2.4.0-22, 2.4.7-17
cups-lpd - addressed in versions 2.4.0-22, 2.4.7-17
cups-printerapp - addressed in versions 2.4.0-22, 2.4.7-17
cups-filesystem - addressed in versions 2.4.0-22, 2.4.7-17
cups-help - addressed in versions 2.4.0-22, 2.4.7-17

• https://github.com/OpenPrinting/cups/security/advisories/GHSA-559w-7676-3xrq

• openEuler 22.03 LTS SP4 update for cups
• openEuler 24.03 LTS SP4 update for cups
• openEuler 24.03 LTS SP3 update for cups
• Multiple vulnerabilities in cups
• SUSE update for cups
• SUSE update for cups