REDHAT-BUG-2548399: Medium severity OpenPrinting CUPS vulnerability
A flaw was found in CUPS when processing embedded job ticket comments in PostScript or PDF documents. The readjobticket() function in scheduler/ipp.c allows a job-ticket option named attributes-natural-language to replace the valid IPP operation attribute with a keyword attribute, because the replacement lookup does not restrict the attribute group. When the job starts, cupsdContinueJob() in scheduler/job.c looks up the attribute as IPPTAGLANGUAGE and dereferences the NULL result without checking it. An unauthenticated client permitted to submit jobs to an accepting shared printer queue can send a single crafted IPP Print-Job request to crash cupsd before any document filter or backend starts, temporarily interrupting printing for all users. The upstream report reproduced the crash on CUPS 2.4.19, 2.4.20, and the 2.4.x development branch. Loopback-only deployments are not remotely reachable through this path. The ticket states that the service automatically restarts after failure; no confidentiality or integrity impact is demonstrated. Validation associated with CVE-2026-61702 does not prevent this issue because job-ticket processing modifies the attribute after that validation. Upstream fixes restrict job-ticket attributes and disable job-ticket comment processing by default in the 2.4.x branch, and remove this functionality in the branch for 2.5 and later.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable job-ticket comment processing; upstream fixes disable this functionality by default in the 2.4.x branch.
CUPS job-ticket comment processing = disabled
Event History
Frequently Asked Questions
Which deployments are exposed to remote exploitation?
Shared printer queues that accept job submissions from unauthenticated clients are exposed. Deployments limited to loopback-only access are not remotely reachable through this path.
What must an attacker do to trigger the crash?
An attacker needs permission to submit a job to an accepting shared queue and can send one crafted IPP Print-Job request containing a PostScript or PDF document with an embedded job-ticket comment. The crash occurs before document filters or backends start.
What is the operational impact if exploited?
The crafted job crashes cupsd, temporarily interrupting printing for all users. The service is reported to restart automatically, and no confidentiality or integrity impact is demonstrated.
Does validation associated with CVE-2026-61702 prevent this issue?
No. Job-ticket processing can modify the affected attribute after the CVE-2026-61702-associated validation has occurred.