Double free in cups - CVE-2026-107886

Vulnerability identifier: #VU154073

CSH Severity: Low

CVSS v4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-107886

CWE-ID: CWE-415

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to a double free in the cupsd class-management functions add_class() and cupsdDeletePrinter() when processing class modification and deletion requests. A local privileged user can modify an existing populated class with an invalid member URI and then delete the class to cause a denial of service.

Exploitation requires an existing printer queue to serve as the initial valid class member.

cups
Anolis OS
cups
cups-client
cups-devel
cups-ipptool
cups-libs
cups-lpd
cups-printerapp
cups-doc
cups-filesystem

Install security update from vendor's website.

cups - update to 2.4.20
cups - update to 2.4.10-9
cups-client - update to 2.4.10-9
cups-devel - update to 2.4.10-9
cups-ipptool - update to 2.4.10-9
cups-libs - update to 2.4.10-9
cups-lpd - update to 2.4.10-9
cups-printerapp - update to 2.4.10-9
cups-doc - update to 2.4.10-9
cups-filesystem - update to 2.4.10-9

• https://github.com/OpenPrinting/cups/security/advisories/GHSA-pwg4-pv39-8c22
• https://github.com/OpenPrinting/cups/commit/13bc9d4f8d695403d54469cc3c8b675e34a7037f

• Multiple vulnerabilities in cups
• Anolis OS update for cups