CVE-2026-6645: Insecure Search Path Vulnerability in PaperCut Print Deploy Client for Windows
An insecure process execution vulnerability exists in the pc-printer-updater.exe component of the PaperCut Print Deploy Client for Windows. The application, which typically operates with high-level system privileges, attempts to perform an internal validation check by invoking a secondary system utility using an unqualified file reference.
Because the application does not specify an absolute path to this utility, it relies on the operating system's default search order to locate the executable. Under specific conditions, a local attacker with the ability to modify directories within the system's search path could plant a malicious binary that mimics the expected utility. This could result in the malicious code being executed with SYSTEM privileges, leading to a full compromise of the affected host.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Modify the application or its configuration so it invokes pc-printer-updater.exe using the full absolute file path instead of relying on the operating system's default search order.
PaperCut Print Deploy Client for Windows (pc-printer-updater.exe) invocation_path = absolute path to pc-printer-updater.exe (do not use an unqualified filename) - Compensating control
Prevent non-privileged users from writing to any directories that are part of the Windows executable search path. Harden NTFS permissions on directories in PATH and service working directories (remove write access for local users), enable auditing for creation of new executables in those directories, and block or monitor additions of unexpected binaries.
- Operational
Search directories in the system search path for unauthorized or unexpected copies of pc-printer-updater.exe (and similarly named utilities); remove or quarantine any malicious binaries and restore legitimate copies from a known-good source. Verify services that invoke the utility are pointing to the intended executable.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-6645?
CVE-2026-6645 has a high severity rating of 7.3 according to the CVSS v4.0.
How do I fix CVE-2026-6645?
To mitigate CVE-2026-6645, update to the latest version of the PaperCut Print Deploy Client for Windows that addresses this vulnerability.
What is CVE-2026-6645 about?
CVE-2026-6645 is an insecure search path vulnerability in the pc-printer-updater.exe component of the PaperCut Print Deploy Client for Windows.
What are the potential impacts of CVE-2026-6645?
Exploitation of CVE-2026-6645 could allow an attacker to execute arbitrary code with elevated system privileges.
When was CVE-2026-6645 published?
CVE-2026-6645 was published on June 22, 2026.