Stack-based buffer overflow in cups - #VU154076
Published: October 12, 2026
Vulnerability details
The vulnerability allows a remote privileged user to cause a denial of service.
The vulnerability exists due to a stack-based buffer overflow in backend_init_supplies() in backend/snmp-supplies.c when assembling marker-names from SNMP supply descriptions without checking the remaining buffer capacity. A remote privileged user can supply specially crafted SNMP responses to cause a denial of service.
Exploitation requires SNMP supply polling to be enabled. Third-party injection requires the ability to observe and inject SNMP traffic, but does not require controlling or spoofing the configured printer because response sender addresses are not validated. Persistent failure requires a writable and reusable SNMP cache.