OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, copybanner() in scheduler/ipp.c uses the attacker-controlled IPP attributes-natural-language value as a directory component beneath DataDir/banners when processing a job-sheets banner. The job-sheets value must first match a registered banner basename, and the traversed path must contain a matching reachable basename; selecting an arbitrary target as demonstrated additionally requires pre-positioned path state such as a symlink with that basename. Subject to the scheduler's filesystem and sandbox access, path separators in the language value can escape the intended banner directory, make the root scheduler open the reachable file, and copy its bytes into a job-sheet spool object that a configured backend can deliver to an attacker-observable endpoint. This issue is fixed in version 2.4.20.

OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, the backend/ipp.c quotestring() function preserves carriage-return and line-feed characters in a remote printer-controlled marker-message before reportattr() writes the value to the scheduler status stream. The scheduler can parse an injected newline as a separate PPD: control line and persist an attacker-selected PPD keyword. The reporter demonstrated that a later print job on a Foomatic-backed queue could consume an injected FoomaticRIPCommandLine value and execute in the filter context as lp. This issue is fixed in version 2.4.20.

OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, copymodel() in scheduler/ipp.c creates a predictable TempDir/<connection-number>.ppd path in an lp-group-writable directory and opens it as root without OEXCL or ONOFOLLOW. Exploitation requires an lp-group process able to write that directory to predict the connection-derived name and plant a symlink before the root open, while a privileged add-printer or modify-printer operation using a model PPD triggers copymodel(). The reporter treats an existing lp foothold and the privileged operation as distinct prerequisites, while the maintainer assesses high privileges because installing the relevant filter or administering the printer requires root or print-administrator access. If the race succeeds, the root scheduler follows the symlink and truncates or overwrites a root-writable target with generated PPD data, compromising file integrity or availability. This issue is fixed in version 2.4.20.

OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, the cupsdCreateJob option-string builder in scheduler/job.c maps attacker-controlled destination-uri and pre-dial-string values from a configured fax queue to the phone and faxPrefix options. Unlike ordinary IPP job attributes, these mapped fax values bypass the control-character sanitizer and are copied directly into the filter options argument. A user permitted to submit a job can therefore inject control characters into the downstream option stream. The reporter states that a downstream fax filter passing these values to a shell or modem command could execute code as lp, while the maintainer states that CUPS has no confidentiality or integrity impact because the only known code-executing filter is optional Foomatic and addressed separately, leaving possible disruption of the affected queue. This issue is fixed in version 2.4.20.

A flaw was found in CUPS when processing embedded job ticket comments in PostScript or PDF documents. The readjobticket() function in scheduler/ipp.c allows a job-ticket option named attributes-natural-language to replace the valid IPP operation attribute with a keyword attribute, because the replacement lookup does not restrict the attribute group. When the job starts, cupsdContinueJob() in scheduler/job.c looks up the attribute as IPPTAGLANGUAGE and dereferences the NULL result without checking it. An unauthenticated client permitted to submit jobs to an accepting shared printer queue can send a single crafted IPP Print-Job request to crash cupsd before any document filter or backend starts, temporarily interrupting printing for all users. The upstream report reproduced the crash on CUPS 2.4.19, 2.4.20, and the 2.4.x development branch. Loopback-only deployments are not remotely reachable through this path. The ticket states that the service automatically restarts after failure; no confidentiality or integrity impact is demonstrated. Validation associated with CVE-2026-61702 does not prevent this issue because job-ticket processing modifies the attribute after that validation. Upstream fixes restrict job-ticket attributes and disable job-ticket comment processing by default in the 2.4.x branch, and remove this functionality in the branch for 2.5 and later.

OpenPrinting CUPS before 2.4.20 contains a NULL pointer dereference caused by repeated IPP group tags in job-creation requests. IPP parsing creates unnamed separator attributes with IPPTAGZERO, but addjob() converts these separators to IPPTAGJOB. During job startup, getoptions()/ipplength() subsequently calls strlen() on a NULL attribute name, terminating cupsd and disrupting all queues. A single crafted Print-Job request can trigger the crash when the client can reach the scheduler and submit jobs to an accepting, enabled queue supporting the submitted document format. Anonymous submission is possible when permitted by listener and access-control configuration.

OpenPrinting CUPS before 2.4.20 contains a NULL pointer dereference in cupsdCheckJobs() when a job marked job-held-on-create refers to a temporary printer that has been automatically deleted. Temporary-printer cleanup can remove the destination without canceling its held jobs, and the scheduler dereferences the NULL result of cupsdFindDest() while checking holdingnewjobs. This terminates cupsd and interrupts all queues managed by that process. In some plausible scenarios, an unprivileged submission can trigger this.

OpenPrinting CUPS before 2.4.20 contains a double-free in printer-class management. When CUPS-Add-Modify-Class replaces an existing class member list, addclass() frees pclass->printers without clearing the pointer. If subsequent validation fails, the class retains the dangling pointer; CUPS-Delete-Class subsequently frees the same allocation in cupsdDeletePrinter(). A client authorized to modify and delete classes can cause scheduler-wide denial of service. The default policy requires @SYSTEM privileges.

OpenPrinting CUPS through 2.4.20 contains a resource-exhaustion vulnerability in the submission-timeout handling of cupsdCheckJobs(). The scheduler suppresses timeout processing for all pending jobs whenever any client connection has an in-flight Send-Document operation, without matching that connection to the job being examined. A client allowed to reach the IPP service can hold an incomplete HTTP request containing parsed Send-Document headers before operation authorization, preventing unrelated incomplete jobs from expiring. Where Create-Job submission is allowed, incomplete jobs can accumulate until MaxJobs is exhausted and further legitimate print submissions are rejected. The suppression ends when the held connection closes.

Hi all!

For more details check SECURITY.md in CUPS project.

The new soon-to-be version 2.4.20 includes fixes: https://github.com/OpenPrinting/cups/security/advisories/GHSA-jj94-x3qh-ffp9 https://github.com/OpenPrinting/cups/security/advisories/GHSA-7j85-5r23-xhvh https://github.com/OpenPrinting/cups/security/advisories/GHSA-gq9p-4w7m-2f5g https://github.com/OpenPrinting/cups/security/advisories/GHSA-w9hj-hq9p-m7f6 https://github.com/OpenPrinting/cups/security/advisories/GHSA-559w-7676-3xrq https://github.com/OpenPrinting/cups/security/advisories/GHSA-qqm8-4q5h-jg55 https://github.com/OpenPrinting/cups/security/advisories/GHSA-fw7q-ww8w-phx8 https://github.com/OpenPrinting/cups/security/advisories/GHSA-wjc4-qhjr-5m5x https://github.com/OpenPrinting/cups/security/advisories/GHSA-7hqf-mfhx-7r3v https://github.com/OpenPrinting/cups/security/advisories/GHSA-gj33-wxpv-6fgg https://github.com/OpenPrinting/cups/security/advisories/GHSA-r8jp-q6fh-g5r2 https://github.com/OpenPrinting/cups/security/advisories/GHSA-r4wf-366f-f6g3 https://github.com/OpenPrinting/cups/security/advisories/GHSA-69qc-prxg-h2c7 https://github.com/OpenPrinting/cups/security/advisories/GHSA-pwg4-pv39-8c22

Have a nice day!

Zdenek

-- Zdenek Dohnal Senior Software Engineer Red Hat, BRQ-TPBC

An argument injection flaw was found in CUPS. When email notification is configured, the CUPS scheduler accepts printer subscription requests that supply a mailto notify-recipient-uri. The mailto notifier passes the recipient address to the configured sendmail program without ensuring it cannot be interpreted as command-line options. A remote attacker who can reach the CUPS service could supply a crafted recipient value starting with "-" to influence sendmail behavior. Successful exploitation depends on the installed mail transfer agent and CUPS network exposure, and may lead to execution of attacker-controlled commands with the privileges of the CUPS service user.

CUPS (Common UNIX Printing System) scheduler accepts IPP Create-Printer-Subscription requests with a notify-recipient-uri attribute. In scheduler/ipp.c, createprintersubscription validates only the URI scheme (notifier type) and does not validate the recipient address portion of mailto: URIs.

When a subscribed event fires, the mailto notifier in notifier/mailto.c passes the recipient string verbatim as a command-line argument to the configured sendmail binary (pipesendmail / execvp) without rejecting leading "-" characters or inserting a "--" separator. A notify-recipient-uri such as mailto:-tC/path/to/crafted.cf is therefore interpreted by traditional sendmail as option arguments (argument injection, CWE-88).

Combined with anonymous Create-Printer-Subscription under default cupsd policy and the ability to stage attacker-controlled files in the CUPS spool via Print-Job, this can chain to arbitrary command execution as the CUPS filter user (lp) when cupsd is network-reachable and a traditional sendmail implementation that honors -C is installed and configured in mailto.conf.

Upstream advisory: GHSA-r4wf-366f-f6g3 (OpenPrinting/cups). Upstream affected version cited: 2.4.7. Upstream fixes on master (1244ed9) and 2.4.x (611d1bd) validate notification email addresses and harden sendmail invocation.

PSIRT ticket: PSIRTSUPT-24443

Cups: openprinting cups: heap out-of-bounds read in cupsutf32toutf8() via missing source-length bound

The cupsUTF32ToUTF8() function in cups/transcode.c lacks a source-length parameter and reads until encountering a zero word or exhausting output capacity. This vulnerability is reachable through SNMP supply-description parsing in backend/snmp-supplies.c using a 1025-byte fixed buffer with attacker-controlled content, resulting in heap out-of-bounds read.

The function reads 8-byte words on 64-bit platforms (where cupsutf32t is unsigned long) without bounds checking on the source buffer, while the destination buffer constraint alone proves insufficient for preventing overread.

Affected versions: <= master (verified against 8a109df, 2026-07-31). No patched release listed at time of advisory.

Reference: https://github.com/OpenPrinting/cups/security/advisories/GHSA-559w-7676-3xrq

Cups: openprinting cups: remaining case-insensitive username matching in scheduler side paths (cve-2026-27447 follow-up)

The OpenPrinting CUPS project contains two instances of case-insensitive username comparisons in authorization-adjacent code paths that were not addressed by the original CVE-2026-27447 fix. These exist in the printer ACL validation logic and private-attribute filtering mechanisms:

1. scheduler/ipp.c:checkquotas() - uses cupsstrcasecmp() for printer ACL username matching 2. scheduler/policy.c:cupsdGetPrivateAttrs() - uses cupsstrcasecmp() for @OWNER and explicit username checks

These patterns were removed from the primary authorization path in the original CVE-2026-27447 fix but persist in these secondary paths.

Affected versions: < 2.4.20. No patched release listed at time of advisory (fixes committed but not yet released).

Reference: https://github.com/OpenPrinting/cups/security/advisories/GHSA-r8jp-q6fh-g5r2

Last updated 8 June 2026

On 2026-04-08 03:40, Peter Gutmann wrote: Under Ubuntu it's installed by default and deeply embedded into things (some packages can't be removed at all, try a 'sudo apt purge libcups' but whatever you do don't hit 'y') libcups itself is only the client side that does not seem vulnerable to any of the issues, cupsd can be managed like any other daemon, and worst case can be firewalled off if that does not work for whatever reason.

CVE-2026-34980 and CVE-2026-34990

https://heyitsas.im/posts/cups/ discloses: 1. CVE-2026-34980: Shared PostScript queue lets anonymous Print-Job requests reach lp code execution over the network

2. CVE-2026-34990: Local print admin token disclosure using temporary printers

At a high level, in the first vulnerability, the attacker:

1. Submits a malicious print job to a shared PostScript queue, 2. Gets CUPS to treat attacker-controlled text as a trusted queue config by abusing a parsing bug, and 3. Gets code execution as the CUPS service user, lp (vim in the PoC)

And in the second vulnerability, the attacker:

1. Uses any unprivileged local user to set up a localhost listener, 2. Creates a local printer object in CUPS, pointing it at the listener above, 3. Gets CUPS to authenticate to it and captures the auth token, 4. Creates another queue pointing at file:///... for the target rootful write, 5. Uses the token to race against CUPS validation logic’s cleanup of the dangerous queue, and 6. Writes what they want into the target file:///... (/etc/sudoers.d/... in the PoC)

any unprivileged local user that can bind on some TCP port and reach the local CUPS listener.

Are you affected? + Mitigation

The unauth’d RCE as lp (CVE-2026-34980) requires the CUPS server to be reachable over the network and expose a shared PostScript queue (these are legacy, but still used). This would be a deliberate config choice – realistic for, say, networked printing servers in your corporate environment, but not for your desktop (unless you for some reason set it up to be a remote printing server).

The LPE to root file (over)write (CVE-2026-34990), on the other hand, works on the stock CUPS config.

For both issues, the harm can be limited by a security module that confines CUPS (e.g., SELinux, AppArmor, etc.). So, if you run CUPS under a sane security policy (default on some distributions), the impact of both As of 4/5/2026, there are public commits with fixes to both issues but no fixed release (latest being 2.4.16). So, your best mitigations are:

Do not expose CUPS over the network with a shared PostScript queue – or at all If you must use a shared queue, require auth for job submissions to that queue Make sure your CUPS runs under a reasonable AppArmor/SELinux/etc. policy, so that the impact is minimized even if you are targeted Further details, including about how the bugs were found and the PoC can be found in the blog post at https://heyitsas.im/posts/cups/ and the article at https://www.theregister.com/2026/04/06/aiagentscupsserverrce/

The CUPS maintainers have published advisories for the above at:

CVE-2026-34980: https://github.com/OpenPrinting/cups/security/advisories/GHSA-4852-v58g-6cwf

CVE-2026-34990: https://github.com/OpenPrinting/cups/security/advisories/GHSA-c54j-2vqw-wpwp

Additionally, in the past week they've also published advisories for:

CVE-2026-27447: Authorization bypass via case-insensitive group-member lookup https://github.com/OpenPrinting/cups/security/advisories/GHSA-v987-m8hp-phj9

CVE-2026-34978: Path traversal in RSS notify-recipient-uri enables file write outside CacheDir/rss (and clobbering of job.cache) https://github.com/OpenPrinting/cups/security/advisories/GHSA-f53q-7mxp-9gcr

CVE-2026-34979: Heap overflow in getoptions() https://github.com/OpenPrinting/cups/security/advisories/GHSA-6qxf-7jx6-86fh

CVE-2026-39314: Integer underflow in ppdCreateFromIPP causes root cupsd crash via negative job-password-supported https://github.com/OpenPrinting/cups/security/advisories/GHSA-pp8w-2g52-7vj7

CVE-2026-39316: Use-after-free in cupsdDeleteTemporaryPrinters via dangling subscription pointer https://github.com/OpenPrinting/cups/security/advisories/GHSA-pjv5-prqp-46rg

<no CVE>: Out-of-bounds heap read in cupsdSetPrinterAttr marker-types parsing https://github.com/OpenPrinting/cups/security/advisories/GHSA-qfp8-9frx-5j48

-- -Alan Coopersmith- alan.coopersmith () oracle com Oracle Solaris Engineering - https://blogs.oracle.com/solaris

CUPS has a use-after-free in cupsdDeleteTemporaryPrinters via dangling subscription pointer

CUPS has an integer underflow in ppdCreateFromIPP causes root cupsd crash via negative job-password-supported

OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.16 and prior, in a network-exposed cupsd with a shared target queue, an unauthorized client can send a Print-Job to that shared PostScript queue without authentication. The server accepts a page-border value supplied as textWithoutLanguage, preserves an embedded newline through option escaping and reparse, and then reparses the resulting second-line PPD: text as a trusted scheduler control record. A follow-up raw print job can therefore make the server execute an attacker-chosen existing binary such as /usr/bin/vim as lp. At time of publication, there are no publicly available patches.

Last updated 8 June 2026

Accelerate Framework. An out-of-bounds write issue was addressed with improved bounds checking.

Last updated 8 June 2026

Last updated 8 June 2026

Last updated 8 June 2026

A client that connects to cupsd but sends slow messages, e.g. only one byte per second, delays cupsd as a whole, such that it becomes unusable by other clients.

A user in group defined by SystemGroup directive in /etc/cups/cups-files.conf can use the cups web ui to change the config and insert a malicious line. Then the cupsd process which runs as root will parse the new config and cause an out-of-bound write.