SUSE-SU-2026:5183-1: Security update for cups

Q: What access does an attacker need to exploit this issue?

The issue is described as allowing unauthenticated remote code execution, so an attacker does not need prior authentication. The provided data does not specify any additional network, service exposure, or configuration prerequisites.

Q: Which component should be prioritized for remediation?

Prioritize systems running the SUSE cups package, particularly where the mailto notifier is enabled or reachable. The update addresses argument injection in that notifier.

Q: How severe is this update considered?

The advisory assigns a risk score of 86, indicating this should be treated as a high-priority security update due to the reported unauthenticated remote code execution impact.

Published Nov 10, 2026

Updated

This update for cups fixes the following issue:

- CVE-2026-105326: argument injection in mailto notifier allows unauthenticated remote code execution (bsc#1284274).

Affected Software

2 affected componentsFixes available

suse/cups<1.7.5-20.76.1

1.7.5-20.76.1

suse/cups<1.7.5-20.76.1

1.7.5-20.76.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade suse/cups to a version that resolves this vulnerability.
Fixed in 1.7.5-20.76.1

Event History

Nov 10, 2026

Advisory Published

via OSV·05:41 PM

Data Sourced

via OSV·05:41 PM

DescriptionAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-105326

Frequently Asked Questions

What access does an attacker need to exploit this issue?

The issue is described as allowing unauthenticated remote code execution, so an attacker does not need prior authentication. The provided data does not specify any additional network, service exposure, or configuration prerequisites.

Which component should be prioritized for remediation?

Prioritize systems running the SUSE cups package, particularly where the mailto notifier is enabled or reachable. The update addresses argument injection in that notifier.

How severe is this update considered?

The advisory assigns a risk score of 86, indicating this should be treated as a high-priority security update due to the reported unauthenticated remote code execution impact.

SUSE-SU-2026:5183-1: Security update for cups

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

What access does an attacker need to exploit this issue?

Which component should be prioritized for remediation?

How severe is this update considered?

Company

Resources

Contact

Frequently Asked Questions

What access does an attacker need to exploit this issue?

Which component should be prioritized for remediation?

How severe is this update considered?