Input validation error in cups - #VU154072
Published: October 12, 2026
Vulnerability identifier: #VU154072
CSH Severity: Low
CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-20
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to forge persistent print-job status and audit metadata.
The vulnerability exists due to improper input validation in the read-only IPP attribute filter in add_job() when processing duplicate client-supplied job attributes. A local user can submit a Print-Job or Create-Job request containing duplicate read-only attributes to forge persistent print-job status and audit metadata.
The surviving client-supplied attributes precede scheduler-generated values and are returned to all clients through first-match attribute lookups. This exploitation path is reachable in the default configuration.
Affected software
cups
Remediation
Install security update from vendor's website.
cups - update to 2.4.20