REDHAT-BUG-2530994: Medium severity OpenPrinting CUPS vulnerability
The cupsUTF32ToUTF8() function in cups/transcode.c lacks a source-length parameter and reads until encountering a zero word or exhausting output capacity. This vulnerability is reachable through SNMP supply-description parsing in backend/snmp-supplies.c using a 1025-byte fixed buffer with attacker-controlled content, resulting in heap out-of-bounds read.
The function reads 8-byte words on 64-bit platforms (where cupsutf32t is unsigned long) without bounds checking on the source buffer, while the destination buffer constraint alone proves insufficient for preventing overread.
Affected versions: <= master (verified against 8a109df, 2026-07-31). No patched release listed at time of advisory.
Reference: https://github.com/OpenPrinting/cups/security/advisories/GHSA-559w-7676-3xrq
Affected Software
Event History
Frequently Asked Questions
What systems are realistically exposed to this issue?
Systems running an affected OpenPrinting CUPS version are exposed when CUPS processes SNMP supply-description data. The vulnerable path is in the SNMP supplies backend parser.
What does an attacker need to exploit it?
An attacker needs to provide attacker-controlled content in an SNMP supply description that reaches the CUPS SNMP supply-description parsing path. The issue can cause a heap out-of-bounds read because the UTF-32 conversion routine does not receive the source buffer length.
Are current development builds affected?
Yes. The issue was verified against commit 8a109df on 2026-07-31, and the affected range is listed as versions up to and including master.
Is a patched release available?
No patched release was listed at the time of the advisory.