CVE-2026-55453: CUPS ipp backend status-line injection can update queue PPD and lead to conditional RCE as lp via foomatic-rip
OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, the backend/ipp.c quotestring() function preserves carriage-return and line-feed characters in a remote printer-controlled marker-message before reportattr() writes the value to the scheduler status stream. The scheduler can parse an injected newline as a separate PPD: control line and persist an attacker-selected PPD keyword. The reporter demonstrated that a later print job on a Foomatic-backed queue could consume an injected FoomaticRIPCommandLine value and execute in the filter context as lp. This issue is fixed in version 2.4.20.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenPrinting CUPSto a version that resolves this vulnerability.Fixed in 2.4.20
Event History
Frequently Asked Questions
Which systems are exposed to code execution?
Exposure requires CUPS before 2.4.20, a queue that communicates with a malicious or attacker-controlled remote IPP printer, and a later print job on a Foomatic-backed queue. The demonstrated command execution occurs in the print filter context as the lp user.
Does exploitation require an authenticated CUPS user or direct access to the host?
The supplied vector indicates no privileges are required, but user interaction is required. The described injection originates from a remote printer-controlled marker message and is consumed only when a later print job is processed by an affected Foomatic-backed queue.
What should be done if CUPS cannot be updated immediately?
The provided information identifies remote IPP printers and Foomatic-backed queues as the relevant conditions. Until updating to 2.4.20, avoid using untrusted or attacker-controlled remote IPP printers with affected queues and avoid processing print jobs through Foomatic-backed queues where possible.
How can an administrator determine whether a queue may have been modified?
Inspect queue PPD configuration for unexpected or attacker-selected PPD keywords, particularly a FoomaticRIPCommandLine value. The issue allows an injected scheduler status line to be persisted as a PPD control line.