Cups: openprinting cups: heap out-of-bounds read in cupsutf32toutf8() via missing source-length bound

The cupsUTF32ToUTF8() function in cups/transcode.c lacks a source-length parameter and reads until encountering a zero word or exhausting output capacity. This vulnerability is reachable through SNMP supply-description parsing in backend/snmp-supplies.c using a 1025-byte fixed buffer with attacker-controlled content, resulting in heap out-of-bounds read.

The function reads 8-byte words on 64-bit platforms (where cupsutf32t is unsigned long) without bounds checking on the source buffer, while the destination buffer constraint alone proves insufficient for preventing overread.

Affected versions: <= master (verified against 8a109df, 2026-07-31). No patched release listed at time of advisory.

Reference: https://github.com/OpenPrinting/cups/security/advisories/GHSA-559w-7676-3xrq

Cups: openprinting cups: remaining case-insensitive username matching in scheduler side paths (cve-2026-27447 follow-up)

The OpenPrinting CUPS project contains two instances of case-insensitive username comparisons in authorization-adjacent code paths that were not addressed by the original CVE-2026-27447 fix. These exist in the printer ACL validation logic and private-attribute filtering mechanisms:

1. scheduler/ipp.c:checkquotas() - uses cupsstrcasecmp() for printer ACL username matching 2. scheduler/policy.c:cupsdGetPrivateAttrs() - uses cupsstrcasecmp() for @OWNER and explicit username checks

These patterns were removed from the primary authorization path in the original CVE-2026-27447 fix but persist in these secondary paths.

Affected versions: < 2.4.20. No patched release listed at time of advisory (fixes committed but not yet released).

Reference: https://github.com/OpenPrinting/cups/security/advisories/GHSA-r8jp-q6fh-g5r2

libcupsfilters through 2.1.1 contains a denial-of-service flaw in cfIEEE1284NormalizeMakeModel() in cupsfilters/ieee1284.c. When processing an IEEE-1284 device ID with an empty MDL field, modelptr equals buffer after copying zero model characters, causing the dedup loop at line 1122 to call strncasecmp(buffer, modelptr, 0) which always returns 0 and moverightpart(buffer, bufsize, modelptr, 0) which makes no progress. The loop never terminates and pins one CPU core indefinitely. The function is reachable over the network via cfIEEE1284GetMakeModel() called by cups-browsed on printer-advertised device IDs (IPP/DNS-SD). CWE-835. No upstream fix; PR #139 / commit 7c45e5f addresses an adjacent OOB-read only.

Last updated 8 June 2026

On 2026-04-08 03:40, Peter Gutmann wrote: Under Ubuntu it's installed by default and deeply embedded into things (some packages can't be removed at all, try a 'sudo apt purge libcups' but whatever you do don't hit 'y') libcups itself is only the client side that does not seem vulnerable to any of the issues, cupsd can be managed like any other daemon, and worst case can be firewalled off if that does not work for whatever reason.

CVE-2026-34980 and CVE-2026-34990

https://heyitsas.im/posts/cups/ discloses: 1. CVE-2026-34980: Shared PostScript queue lets anonymous Print-Job requests reach lp code execution over the network

2. CVE-2026-34990: Local print admin token disclosure using temporary printers

At a high level, in the first vulnerability, the attacker:

1. Submits a malicious print job to a shared PostScript queue, 2. Gets CUPS to treat attacker-controlled text as a trusted queue config by abusing a parsing bug, and 3. Gets code execution as the CUPS service user, lp (vim in the PoC)

And in the second vulnerability, the attacker:

1. Uses any unprivileged local user to set up a localhost listener, 2. Creates a local printer object in CUPS, pointing it at the listener above, 3. Gets CUPS to authenticate to it and captures the auth token, 4. Creates another queue pointing at file:///... for the target rootful write, 5. Uses the token to race against CUPS validation logic’s cleanup of the dangerous queue, and 6. Writes what they want into the target file:///... (/etc/sudoers.d/... in the PoC)

any unprivileged local user that can bind on some TCP port and reach the local CUPS listener.

Are you affected? + Mitigation

The unauth’d RCE as lp (CVE-2026-34980) requires the CUPS server to be reachable over the network and expose a shared PostScript queue (these are legacy, but still used). This would be a deliberate config choice – realistic for, say, networked printing servers in your corporate environment, but not for your desktop (unless you for some reason set it up to be a remote printing server).

The LPE to root file (over)write (CVE-2026-34990), on the other hand, works on the stock CUPS config.

For both issues, the harm can be limited by a security module that confines CUPS (e.g., SELinux, AppArmor, etc.). So, if you run CUPS under a sane security policy (default on some distributions), the impact of both As of 4/5/2026, there are public commits with fixes to both issues but no fixed release (latest being 2.4.16). So, your best mitigations are:

Do not expose CUPS over the network with a shared PostScript queue – or at all If you must use a shared queue, require auth for job submissions to that queue Make sure your CUPS runs under a reasonable AppArmor/SELinux/etc. policy, so that the impact is minimized even if you are targeted Further details, including about how the bugs were found and the PoC can be found in the blog post at https://heyitsas.im/posts/cups/ and the article at https://www.theregister.com/2026/04/06/aiagentscupsserverrce/

The CUPS maintainers have published advisories for the above at:

CVE-2026-34980: https://github.com/OpenPrinting/cups/security/advisories/GHSA-4852-v58g-6cwf

CVE-2026-34990: https://github.com/OpenPrinting/cups/security/advisories/GHSA-c54j-2vqw-wpwp

Additionally, in the past week they've also published advisories for:

CVE-2026-27447: Authorization bypass via case-insensitive group-member lookup https://github.com/OpenPrinting/cups/security/advisories/GHSA-v987-m8hp-phj9

CVE-2026-34978: Path traversal in RSS notify-recipient-uri enables file write outside CacheDir/rss (and clobbering of job.cache) https://github.com/OpenPrinting/cups/security/advisories/GHSA-f53q-7mxp-9gcr

CVE-2026-34979: Heap overflow in getoptions() https://github.com/OpenPrinting/cups/security/advisories/GHSA-6qxf-7jx6-86fh

CVE-2026-39314: Integer underflow in ppdCreateFromIPP causes root cupsd crash via negative job-password-supported https://github.com/OpenPrinting/cups/security/advisories/GHSA-pp8w-2g52-7vj7

CVE-2026-39316: Use-after-free in cupsdDeleteTemporaryPrinters via dangling subscription pointer https://github.com/OpenPrinting/cups/security/advisories/GHSA-pjv5-prqp-46rg

<no CVE>: Out-of-bounds heap read in cupsdSetPrinterAttr marker-types parsing https://github.com/OpenPrinting/cups/security/advisories/GHSA-qfp8-9frx-5j48

-- -Alan Coopersmith- alan.coopersmith () oracle com Oracle Solaris Engineering - https://blogs.oracle.com/solaris

CUPS has a use-after-free in cupsdDeleteTemporaryPrinters via dangling subscription pointer

CUPS has an integer underflow in ppdCreateFromIPP causes root cupsd crash via negative job-password-supported

OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.16 and prior, in a network-exposed cupsd with a shared target queue, an unauthorized client can send a Print-Job to that shared PostScript queue without authentication. The server accepts a page-border value supplied as textWithoutLanguage, preserves an embedded newline through option escaping and reparse, and then reparses the resulting second-line PPD: text as a trusted scheduler control record. A follow-up raw print job can therefore make the server execute an attacker-chosen existing binary such as /usr/bin/vim as lp. At time of publication, there are no publicly available patches.

Last updated 8 June 2026

Accelerate Framework. An out-of-bounds write issue was addressed with improved bounds checking.

Last updated 8 June 2026

Last updated 8 June 2026

Last updated 8 June 2026

cups-filters contains backends, filters, and other software required to get the cups printing service working on operating systems other than macos. In versions 2.0.1 and prior, a heap-buffer-overflow vulnerability in the rastertopclx filter causes the program to crash with a segmentation fault when processing maliciously crafted input data. This issue can be exploited to trigger memory corruption, potentially leading to arbitrary code execution. This issue has been patched via commit 956283c.

Hi all,

Commits with fixes in the project:

Have a nice day!

Zdenek

-- Zdenek Dohnal Senior Software Engineer Red Hat, BRQ-TPBC

A client that connects to cupsd but sends slow messages, e.g. only one byte per second, delays cupsd as a whole, such that it becomes unusable by other clients.

A user in group defined by SystemGroup directive in /etc/cups/cups-files.conf can use the cups web ui to change the config and insert a malicious line. Then the cupsd process which runs as root will parse the new config and cause an out-of-bound write.

A user in group defined by SystemGroup directive in /etc/cups/cups-files.conf can use the cups web ui to change the config and insert a malicious line. Then the cupsd process which runs as root will parse the new config and cause an out-of-bound write.

cups-filters contains backends, filters, and other software required to get the cups printing service working on operating systems other than macos. In cups-filters prior to 1.28.18, by crafting a PDF file with a large MediaBox value, an attacker can cause CUPS-Filter 1.x’s pdftoraster tool to write beyond the bounds of an array. First, a PDF with a large MediaBox width value causes header.cupsWidth to become large. Next, the calculation of bytesPerLine = (header.cupsBitsPerPixel header.cupsWidth + 7) / 8 overflows, resulting in a small value. Then, lineBuf is allocated with the small bytesPerLine size. Finally, convertLineChunked calls writePixel8, which attempts to write to lineBuf outside of its buffer size (out of bounds write). In libcupsfilters, the maintainers found the same bytesPerLine multiplication without overflow check, but the provided test case does not cause an overflow there, because the values are different. Commit 50d94ca0f2fa6177613c97c59791bde568631865 contains a patch, which is incorporated into cups-filters version 1.28.18.

CUPS is a standards-based, open-source printing system, and libcupsfilters contains the code of the filters of the former cups-filters package as library functions to be used for the data format conversion tasks needed in Printer Applications. In CUPS-Filters versions up to and including 1.28.17 and libscupsfilters versions 2.0.0 through 2.1.1, CUPS-Filters's imagetoraster filter has an out of bounds read/write vulnerability in the processing of TIFF image files. While the pixel buffer is allocated with the number of pixels times a pre-calculated bytes-per-pixel value, the function which processes these pixels is called with a size of the number of pixels times 3. When suitable inputs are passed, the bytes-per-pixel value can be set to 1 and bytes outside of the buffer bounds get processed. In order to trigger the bug, an attacker must issue a print job with a crafted TIFF file, and pass appropriate print job options to control the bytes-per-pixel value of the output format. They must choose a printer configuration under which the imagetoraster filter or its C-function equivalent cfFilterImageToRaster() gets invoked. The vulnerability exists in both CUPS-Filters 1.x and the successor library libcupsfilters (CUPS-Filters 2.x). In CUPS-Filters 2.x, the vulnerable function is cfImageReadTIFF() in libcupsfilters. When this function is invoked as part of cfFilterImageToRaster(), the caller passes a look-up-table during whose processing the out of bounds memory access happens. In CUPS-Filters 1.x, the equivalent functions are all found in the cups-filters repository, which is not split into subprojects yet, and the vulnerable code is in cupsImageReadTIFF(), which is called through cupsImageOpen() from the imagetoraster tool. A patch is available in commit b69dfacec7f176281782e2f7ac44f04bf9633cfa.

Hi all,

The fix lies in libcupsfilters:

https://github.com/OpenPrinting/cups-filters/commit/50d94ca0f2fa6177613c97c59791bde568631865

and in cups-filters 1.x (which contains libcupsfilters library before 2.x):

https://github.com/OpenPrinting/libcupsfilters/commit/fd01543f372ca3ba1f1c27bd3427110fa0094e3f

The detailed description of vulnerability is present at

https://github.com/OpenPrinting/cups-filters/security/advisories/GHSA-893j-2wr2-wrh9

Have a nice day,

Zdenek Dohnal

-- Zdenek Dohnal Senior Software Engineer Red Hat, BRQ-TPBC

Hi all, - heap-buffer-overflow write in cfImageLut()

- heap-buffer-overflow in cfImageReadTIFF()

- multiple out of bounds reads in cfImageReadTIFF()'s scanline buffer The fixes are present in libcupsfilters project as commits:

https://github.com/OpenPrinting/libcupsfilters/commit/b69dfacec7f17628178 https://github.com/OpenPrinting/cups-filters/commit/5122052dd8f06949242099401c59f6c3b14e61c3

https://github.com/OpenPrinting/cups-filters/commit/cb927006747b797aa9163cd0cbd41b9bbdf05db0

https://github.com/OpenPrinting/cups-filters/commit/719c557c9a29db32b855e6e108d7f4e7c5397613

https://github.com/OpenPrinting/cups-filters/commit/7bd588a1fc5c99ac0b1951beb1b54b438137a7b5

https://github.com/OpenPrinting/cups-filters/commit/5e5f1c5d46a043c57cbbe6e043aa95896d9c40fa

Detailed information about issues are in published advisories:

https://github.com/OpenPrinting/libcupsfilters/security/advisories/GHSA-jpxg-qc2c-hgv4

https://github.com/OpenPrinting/libcupsfilters/security/advisories/GHSA-rc6w-jmvv-v7gx

https://github.com/OpenPrinting/libcupsfilters/security/advisories/GHSA-fmvr-45mx-43c6

Have a nice day!

Zdenek Dohnal

-- Zdenek Dohnal Senior Software Engineer Red Hat, BRQ-TPBC

Hi all! Description

Summary Details

The combination of: Is shown in two places in OpenPrinting:

|cups/scheduler/ipp.c libcupsfilters/cupsfilters/ipp.c | PoC Impact

Metrics:

CVSS v3 base metrics

Attack vector Adjacent Attack complexity Low Privileges required None User interaction None Scope Unchanged Confidentiality None Integrity None Availability High

Credit - https://github.com/SilverPlate3

Patch

https://github.com/OpenPrinting/cups/commit/e58cba9d6f

Have a nice day!

Zdenek

-- Zdenek Dohnal Senior Software Engineer Red Hat, BRQ-TPBC

Hi all,

there is important security vulnerability in CUPS:

Description

Summary Details PoC

- Configure CUPS with |DefaultAuthType Negotiate|. - Start CUPS - cat /etc/cups/cupsd.conf haha

Impact

Patch https://github.com/OpenPrinting/cups/commit/595d691075b1d39

Have a nice day,

Zdenek Dohnal

-- Zdenek Dohnal Senior Software Engineer Red Hat, BRQ-TPBC

cups: Remote DoS via null dereference

Authentication Bypass vulnerability in the authorization handling of the CUPS print server. The flaw exists in the cupsdAuthorize() function (scheduler/auth.c) where, if the configured AuthType is anything other than Basic, but the request still includes an Authorization: Basic ... header, the password validation step is skipped. This allows an attacker to bypass authentication checks entirely. By exploiting this issue, an attacker can perform privileged operations, including modifying configuration files, without providing valid credentials. This vulnerability can be exploited remotely depending on the deployment configuration and does not require valid authentication.