libcupsfilters through 2.1.1 contains a denial-of-service flaw in cfIEEE1284NormalizeMakeModel() in cupsfilters/ieee1284.c. When processing an IEEE-1284 device ID with an empty MDL field, modelptr equals buffer after copying zero model characters, causing the dedup loop at line 1122 to call strncasecmp(buffer, modelptr, 0) which always returns 0 and moverightpart(buffer, bufsize, modelptr, 0) which makes no progress. The loop never terminates and pins one CPU core indefinitely. The function is reachable over the network via cfIEEE1284GetMakeModel() called by cups-browsed on printer-advertised device IDs (IPP/DNS-SD). CWE-835. No upstream fix; PR #139 / commit 7c45e5f addresses an adjacent OOB-read only.

Last updated 8 June 2026

On 2026-04-08 03:40, Peter Gutmann wrote: Under Ubuntu it's installed by default and deeply embedded into things (some packages can't be removed at all, try a 'sudo apt purge libcups' but whatever you do don't hit 'y') libcups itself is only the client side that does not seem vulnerable to any of the issues, cupsd can be managed like any other daemon, and worst case can be firewalled off if that does not work for whatever reason.

CVE-2026-34980 and CVE-2026-34990

https://heyitsas.im/posts/cups/ discloses: 1. CVE-2026-34980: Shared PostScript queue lets anonymous Print-Job requests reach lp code execution over the network

2. CVE-2026-34990: Local print admin token disclosure using temporary printers

At a high level, in the first vulnerability, the attacker:

1. Submits a malicious print job to a shared PostScript queue, 2. Gets CUPS to treat attacker-controlled text as a trusted queue config by abusing a parsing bug, and 3. Gets code execution as the CUPS service user, lp (vim in the PoC)

And in the second vulnerability, the attacker:

1. Uses any unprivileged local user to set up a localhost listener, 2. Creates a local printer object in CUPS, pointing it at the listener above, 3. Gets CUPS to authenticate to it and captures the auth token, 4. Creates another queue pointing at file:///... for the target rootful write, 5. Uses the token to race against CUPS validation logic’s cleanup of the dangerous queue, and 6. Writes what they want into the target file:///... (/etc/sudoers.d/... in the PoC)

any unprivileged local user that can bind on some TCP port and reach the local CUPS listener.

Are you affected? + Mitigation

The unauth’d RCE as lp (CVE-2026-34980) requires the CUPS server to be reachable over the network and expose a shared PostScript queue (these are legacy, but still used). This would be a deliberate config choice – realistic for, say, networked printing servers in your corporate environment, but not for your desktop (unless you for some reason set it up to be a remote printing server).

The LPE to root file (over)write (CVE-2026-34990), on the other hand, works on the stock CUPS config.

For both issues, the harm can be limited by a security module that confines CUPS (e.g., SELinux, AppArmor, etc.). So, if you run CUPS under a sane security policy (default on some distributions), the impact of both As of 4/5/2026, there are public commits with fixes to both issues but no fixed release (latest being 2.4.16). So, your best mitigations are:

Do not expose CUPS over the network with a shared PostScript queue – or at all If you must use a shared queue, require auth for job submissions to that queue Make sure your CUPS runs under a reasonable AppArmor/SELinux/etc. policy, so that the impact is minimized even if you are targeted Further details, including about how the bugs were found and the PoC can be found in the blog post at https://heyitsas.im/posts/cups/ and the article at https://www.theregister.com/2026/04/06/aiagentscupsserverrce/

The CUPS maintainers have published advisories for the above at:

CVE-2026-34980: https://github.com/OpenPrinting/cups/security/advisories/GHSA-4852-v58g-6cwf

CVE-2026-34990: https://github.com/OpenPrinting/cups/security/advisories/GHSA-c54j-2vqw-wpwp

Additionally, in the past week they've also published advisories for:

CVE-2026-27447: Authorization bypass via case-insensitive group-member lookup https://github.com/OpenPrinting/cups/security/advisories/GHSA-v987-m8hp-phj9

CVE-2026-34978: Path traversal in RSS notify-recipient-uri enables file write outside CacheDir/rss (and clobbering of job.cache) https://github.com/OpenPrinting/cups/security/advisories/GHSA-f53q-7mxp-9gcr

CVE-2026-34979: Heap overflow in getoptions() https://github.com/OpenPrinting/cups/security/advisories/GHSA-6qxf-7jx6-86fh

CVE-2026-39314: Integer underflow in ppdCreateFromIPP causes root cupsd crash via negative job-password-supported https://github.com/OpenPrinting/cups/security/advisories/GHSA-pp8w-2g52-7vj7

CVE-2026-39316: Use-after-free in cupsdDeleteTemporaryPrinters via dangling subscription pointer https://github.com/OpenPrinting/cups/security/advisories/GHSA-pjv5-prqp-46rg

<no CVE>: Out-of-bounds heap read in cupsdSetPrinterAttr marker-types parsing https://github.com/OpenPrinting/cups/security/advisories/GHSA-qfp8-9frx-5j48

-- -Alan Coopersmith- alan.coopersmith () oracle com Oracle Solaris Engineering - https://blogs.oracle.com/solaris

CUPS has a use-after-free in cupsdDeleteTemporaryPrinters via dangling subscription pointer

CUPS has an integer underflow in ppdCreateFromIPP causes root cupsd crash via negative job-password-supported

OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.16 and prior, in a network-exposed cupsd with a shared target queue, an unauthorized client can send a Print-Job to that shared PostScript queue without authentication. The server accepts a page-border value supplied as textWithoutLanguage, preserves an embedded newline through option escaping and reparse, and then reparses the resulting second-line PPD: text as a trusted scheduler control record. A follow-up raw print job can therefore make the server execute an attacker-chosen existing binary such as /usr/bin/vim as lp. At time of publication, there are no publicly available patches.

Last updated 8 June 2026

Last updated 8 June 2026

Last updated 8 June 2026

Last updated 8 June 2026

Last updated 8 June 2026

cups-filters contains backends, filters, and other software required to get the cups printing service working on operating systems other than macos. In versions 2.0.1 and prior, a heap-buffer-overflow vulnerability in the rastertopclx filter causes the program to crash with a segmentation fault when processing maliciously crafted input data. This issue can be exploited to trigger memory corruption, potentially leading to arbitrary code execution. This issue has been patched via commit 956283c.

Hi all,

Commits with fixes in the project:

Have a nice day!

Zdenek

-- Zdenek Dohnal Senior Software Engineer Red Hat, BRQ-TPBC

A client that connects to cupsd but sends slow messages, e.g. only one byte per second, delays cupsd as a whole, such that it becomes unusable by other clients.

A user in group defined by SystemGroup directive in /etc/cups/cups-files.conf can use the cups web ui to change the config and insert a malicious line. Then the cupsd process which runs as root will parse the new config and cause an out-of-bound write.

A user in group defined by SystemGroup directive in /etc/cups/cups-files.conf can use the cups web ui to change the config and insert a malicious line. Then the cupsd process which runs as root will parse the new config and cause an out-of-bound write.

cups-filters contains backends, filters, and other software required to get the cups printing service working on operating systems other than macos. In cups-filters prior to 1.28.18, by crafting a PDF file with a large MediaBox value, an attacker can cause CUPS-Filter 1.x’s pdftoraster tool to write beyond the bounds of an array. First, a PDF with a large MediaBox width value causes header.cupsWidth to become large. Next, the calculation of bytesPerLine = (header.cupsBitsPerPixel header.cupsWidth + 7) / 8 overflows, resulting in a small value. Then, lineBuf is allocated with the small bytesPerLine size. Finally, convertLineChunked calls writePixel8, which attempts to write to lineBuf outside of its buffer size (out of bounds write). In libcupsfilters, the maintainers found the same bytesPerLine multiplication without overflow check, but the provided test case does not cause an overflow there, because the values are different. Commit 50d94ca0f2fa6177613c97c59791bde568631865 contains a patch, which is incorporated into cups-filters version 1.28.18.

CUPS is a standards-based, open-source printing system, and libcupsfilters contains the code of the filters of the former cups-filters package as library functions to be used for the data format conversion tasks needed in Printer Applications. In CUPS-Filters versions up to and including 1.28.17 and libscupsfilters versions 2.0.0 through 2.1.1, CUPS-Filters's imagetoraster filter has an out of bounds read/write vulnerability in the processing of TIFF image files. While the pixel buffer is allocated with the number of pixels times a pre-calculated bytes-per-pixel value, the function which processes these pixels is called with a size of the number of pixels times 3. When suitable inputs are passed, the bytes-per-pixel value can be set to 1 and bytes outside of the buffer bounds get processed. In order to trigger the bug, an attacker must issue a print job with a crafted TIFF file, and pass appropriate print job options to control the bytes-per-pixel value of the output format. They must choose a printer configuration under which the imagetoraster filter or its C-function equivalent cfFilterImageToRaster() gets invoked. The vulnerability exists in both CUPS-Filters 1.x and the successor library libcupsfilters (CUPS-Filters 2.x). In CUPS-Filters 2.x, the vulnerable function is cfImageReadTIFF() in libcupsfilters. When this function is invoked as part of cfFilterImageToRaster(), the caller passes a look-up-table during whose processing the out of bounds memory access happens. In CUPS-Filters 1.x, the equivalent functions are all found in the cups-filters repository, which is not split into subprojects yet, and the vulnerable code is in cupsImageReadTIFF(), which is called through cupsImageOpen() from the imagetoraster tool. A patch is available in commit b69dfacec7f176281782e2f7ac44f04bf9633cfa.

Hi all,

The fix lies in libcupsfilters:

https://github.com/OpenPrinting/cups-filters/commit/50d94ca0f2fa6177613c97c59791bde568631865

and in cups-filters 1.x (which contains libcupsfilters library before 2.x):

https://github.com/OpenPrinting/libcupsfilters/commit/fd01543f372ca3ba1f1c27bd3427110fa0094e3f

The detailed description of vulnerability is present at

https://github.com/OpenPrinting/cups-filters/security/advisories/GHSA-893j-2wr2-wrh9

Have a nice day,

Zdenek Dohnal

-- Zdenek Dohnal Senior Software Engineer Red Hat, BRQ-TPBC

Hi all, - heap-buffer-overflow write in cfImageLut()

- heap-buffer-overflow in cfImageReadTIFF()

- multiple out of bounds reads in cfImageReadTIFF()'s scanline buffer The fixes are present in libcupsfilters project as commits:

https://github.com/OpenPrinting/libcupsfilters/commit/b69dfacec7f17628178 https://github.com/OpenPrinting/cups-filters/commit/5122052dd8f06949242099401c59f6c3b14e61c3

https://github.com/OpenPrinting/cups-filters/commit/cb927006747b797aa9163cd0cbd41b9bbdf05db0

https://github.com/OpenPrinting/cups-filters/commit/719c557c9a29db32b855e6e108d7f4e7c5397613

https://github.com/OpenPrinting/cups-filters/commit/7bd588a1fc5c99ac0b1951beb1b54b438137a7b5

https://github.com/OpenPrinting/cups-filters/commit/5e5f1c5d46a043c57cbbe6e043aa95896d9c40fa

Detailed information about issues are in published advisories:

https://github.com/OpenPrinting/libcupsfilters/security/advisories/GHSA-jpxg-qc2c-hgv4

https://github.com/OpenPrinting/libcupsfilters/security/advisories/GHSA-rc6w-jmvv-v7gx

https://github.com/OpenPrinting/libcupsfilters/security/advisories/GHSA-fmvr-45mx-43c6

Have a nice day!

Zdenek Dohnal

-- Zdenek Dohnal Senior Software Engineer Red Hat, BRQ-TPBC

Hi all! Description

Summary Details

The combination of: Is shown in two places in OpenPrinting:

|cups/scheduler/ipp.c libcupsfilters/cupsfilters/ipp.c | PoC Impact

Metrics:

CVSS v3 base metrics

Attack vector Adjacent Attack complexity Low Privileges required None User interaction None Scope Unchanged Confidentiality None Integrity None Availability High

Credit - https://github.com/SilverPlate3

Patch

https://github.com/OpenPrinting/cups/commit/e58cba9d6f

Have a nice day!

Zdenek

-- Zdenek Dohnal Senior Software Engineer Red Hat, BRQ-TPBC

Hi all,

there is important security vulnerability in CUPS:

Description

Summary Details PoC

- Configure CUPS with |DefaultAuthType Negotiate|. - Start CUPS - cat /etc/cups/cupsd.conf haha

Impact

Patch https://github.com/OpenPrinting/cups/commit/595d691075b1d39

Have a nice day,

Zdenek Dohnal

-- Zdenek Dohnal Senior Software Engineer Red Hat, BRQ-TPBC

cups: Remote DoS via null dereference

Authentication Bypass vulnerability in the authorization handling of the CUPS print server. The flaw exists in the cupsdAuthorize() function (scheduler/auth.c) where, if the configured AuthType is anything other than Basic, but the request still includes an Authorization: Basic ... header, the password validation step is skipped. This allows an attacker to bypass authentication checks entirely. By exploiting this issue, an attacker can perform privileged operations, including modifying configuration files, without providing valid credentials. This vulnerability can be exploited remotely depending on the deployment configuration and does not require valid authentication.

A stack based buffer overflow vulnerability is present in OpenPrinting ippusbxd 1.34. A specially configured printer that supports IPP-over-USB can cause a buffer overflow which can lead to a arbitrary code execution in a privileged service. To trigger the vulnerability, a malicious device would need to be connected to the vulnerable system over USB.

On Wed, Jun 12, 2024 at 10:49:28PM -0000, Tavis Ormandy wrote: On 2024-06-11, Zdenek Dohnal wrote: ???????? Impact

Given that cupsd is often running as root, this can result in the change of permission of any user or system files to be world writable.

https://github.com/OpenPrinting/cups/commit/a436956f3 This is a pretty confusing description... if we accept the premise that an attacker can somehow get root to run cupsd with a modified configuration file (how???), then this patch doesn't seem sufficient. They can still get root to unlink() an arbitrary file, no?

I guess someone from CUPS has seen a working Ubuntu exploit that did this, but this really feels like fixing the bug in the wrong place? Yes, here's a blog post on the Ubuntu exploit chain:

Abusing Ubuntu 24.04 features for root privilege escalation Written by: Rory McNamara September 9, 2024 40 mins read

https://snyk.io/blog/abusing-ubuntu-root-privilege-escalation/

This is a lot. I only skimmed. wpasupplicant and CUPS got CVEs, but really it's not so obvious what component(s) to blame/fix.

I've attached my plain text export of the blog post to this message.

Alexander

Hello oss-security,

Thursday, October 3, 2024 at 2:58 PM -04:00 from peter () 7bits nl <peter () 7bits nl>: Hello,

On Thu, Oct 3, 2024, at 19:54, Larry Cashdollar wrote: I've requested a CVE ID to be able to discern between the RCE and the DoS vulnerability. I reported this as https://github.com/OpenPrinting/cups-filters/security/advisories/GHSA-rq86-c7g6-r2h8 last week, and in the edits at the top (by upstream, above the Summary heading) it looks like they did not want (or did not consider) to request a separate CVE for this. Please do coordinate with them if you decide to go ahead with this request.

(I did notice, and can see value in, Will Dormann's suggestion in the other thread that it might make sense to have more fine-grained CVEs for this collection of problems.)

--   Peter van Dijk    peter () 7bits nl This vulnerability has been assigned CVE-2024-47850.

Thanks, Larry C$

Hello, Peter On Oct 3, 2024, at 2:58 PM, Peter van Dijk <peter () 7bits nl> wrote: Hello, On Thu, Oct 3, 2024, at 19:54, Larry Cashdollar wrote: I've requested a CVE ID to be able to discern between the RCE and the DoS vulnerability. I reported this as https://github.com/OpenPrinting/cups-filters/security/advisories/GHSA-rq86-c7g6-r2h8 last week, and in the edits at the top (by upstream, above the Summary heading) it looks like they did not want (or did not consider) to request a separate CVE for this. Please do coordinate with them if you decide to go ahead with this request. (I did notice, and can see value in, Will Dormann's suggestion in the other thread that it might make sense to have more fine-grained CVEs for this collection of problems.) -- Peter van Dijk peter () 7bits nl I'll follow up with them. Thanks! Larry