CVE-2026-107655: Cups: null pointer dereference via embedded job ticket comments allows remote denial of service
A flaw was found in CUPS when processing embedded job ticket comments in PostScript or PDF documents. The readjobticket() function in scheduler/ipp.c allows a job-ticket option named attributes-natural-language to replace the valid IPP operation attribute with a keyword attribute, because the replacement lookup does not restrict the attribute group. When the job starts, cupsdContinueJob() in scheduler/job.c looks up the attribute as IPPTAGLANGUAGE and dereferences the NULL result without checking it. An unauthenticated client permitted to submit jobs to an accepting shared printer queue can send a single crafted IPP Print-Job request to crash cupsd before any document filter or backend starts, temporarily interrupting printing for all users. The upstream report reproduced the crash on CUPS 2.4.19, 2.4.20, and the 2.4.x development branch. Loopback-only deployments are not remotely reachable through this path. The ticket states that the service automatically restarts after failure; no confidentiality or integrity impact is demonstrated. Validation associated with CVE-2026-61702 does not prevent this issue because job-ticket processing modifies the attribute after that validation. Upstream fixes restrict job-ticket attributes and disable job-ticket comment processing by default in the 2.4.x branch, and remove this functionality in the branch for 2.5 and later.
Other sources
A flaw was found in CUPS. When processing embedded job ticket comments within documents, the service improperly handles specific IPP attributes, causing an unhandled null pointer dereference. An unauthenticated attacker permitted to submit jobs to a shared printer queue can send a crafted Internet Printing Protocol (IPP) request to crash the print daemon, resulting in a temporary Denial of Service (DoS) for all printing services.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable embedded job-ticket comment processing; upstream disables this processing by default in the 2.4.x branch.
CUPS embedded job-ticket comment processing = disabled
Event History
Frequently Asked Questions
Which deployments are exposed to remote exploitation?
A CUPS instance is remotely exposed through this flaw only if it has an accepting shared printer queue that permits an unauthenticated client to submit jobs. Loopback-only deployments are not remotely reachable through this path.
What does an attacker need to do to trigger the issue?
The attacker needs to submit one crafted IPP Print-Job request containing embedded job-ticket comments in a PostScript or PDF document. No authentication or user interaction is required where the queue accepts unauthenticated submissions.
What is the operational impact of a successful attack?
The crafted job crashes cupsd before any document filter or backend starts, temporarily interrupting printing for all users. The service is reported to restart automatically, and no confidentiality or integrity impact has been demonstrated.
Are the versions affected by the reported reproduction known?
The upstream report reproduced the crash on CUPS 2.4.19, 2.4.20, and the 2.4.x development branch. The provided data does not establish a complete affected-version range.
Does validation associated with CVE-2026-61702 mitigate this flaw?
No. The provided information states that this validation does not prevent the issue because job-ticket processing modifies the relevant attribute after that validation.