CVE-2026-87875: Cups: openprinting cups: heap out-of-bounds read in cupsutf32toutf8() via missing source-length bound
The cupsUTF32ToUTF8() function in CUPS's cups/transcode.c lacks a source-length bound and can read past the end of the source buffer, resulting in a heap out-of-bounds read. This is reachable via SNMP supply-description parsing in backend/snmp-supplies.c with attacker-controlled content.
Other sources
The cupsUTF32ToUTF8() function in cups/transcode.c lacks a source-length parameter and reads until encountering a zero word or exhausting output capacity. This vulnerability is reachable through SNMP supply-description parsing in backend/snmp-supplies.c using a 1025-byte fixed buffer with attacker-controlled content, resulting in heap out-of-bounds read.
The function reads 8-byte words on 64-bit platforms (where cupsutf32t is unsigned long) without bounds checking on the source buffer, while the destination buffer constraint alone proves insufficient for preventing overread.
Affected versions: <= master (verified against 8a109df, 2026-07-31). No patched release listed at time of advisory.
Reference: https://github.com/OpenPrinting/cups/security/advisories/GHSA-559w-7676-3xrq
— Red Hat
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using OpenPrinting CUPS are affected if they include the vulnerable code; the advisory states affected versions are through master as verified at commit 8a109df on 2026-07-31. No patched release was listed at the time of the advisory.
What must an attacker be able to do to trigger the over-read?
An attacker needs network access to provide attacker-controlled content through SNMP supply-description parsing. No privileges or user interaction are required according to the supplied CVSS vector.
What component and input path should be investigated for exposure?
Investigate the SNMP supply-description handling path in backend/snmp-supplies.c, which passes attacker-controlled content to cupsUTF32ToUTF8() in cups/transcode.c. The relevant parsing uses a fixed 1025-byte buffer, while the UTF-32 conversion lacks a source-length bound.
Is a patch available?
No patched release was listed at the time of the advisory. The provided data does not specify a mitigation or workaround for systems that cannot be patched.