Last updated 8 June 2026

OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.16 and prior, in a network-exposed cupsd with a shared target queue, an unauthorized client can send a Print-Job to that shared PostScript queue without authentication. The server accepts a page-border value supplied as textWithoutLanguage, preserves an embedded newline through option escaping and reparse, and then reparses the resulting second-line PPD: text as a trusted scheduler control record. A follow-up raw print job can therefore make the server execute an attacker-chosen existing binary such as /usr/bin/vim as lp. At time of publication, there are no publicly available patches.

A client that connects to cupsd but sends slow messages, e.g. only one byte per second, delays cupsd as a whole, such that it becomes unusable by other clients.

A user in group defined by SystemGroup directive in /etc/cups/cups-files.conf can use the cups web ui to change the config and insert a malicious line. Then the cupsd process which runs as root will parse the new config and cause an out-of-bound write.

A user in group defined by SystemGroup directive in /etc/cups/cups-files.conf can use the cups web ui to change the config and insert a malicious line. Then the cupsd process which runs as root will parse the new config and cause an out-of-bound write.

Authentication Bypass vulnerability in the authorization handling of the CUPS print server. The flaw exists in the cupsdAuthorize() function (scheduler/auth.c) where, if the configured AuthType is anything other than Basic, but the request still includes an Authorization: Basic ... header, the password validation step is skipped. This allows an attacker to bypass authentication checks entirely. By exploiting this issue, an attacker can perform privileged operations, including modifying configuration files, without providing valid credentials. This vulnerability can be exploited remotely depending on the deployment configuration and does not require valid authentication.

cups: Remote DoS via null dereference

libcupsfilters through 2.1.1 contains a denial-of-service flaw in cfIEEE1284NormalizeMakeModel() in cupsfilters/ieee1284.c. When processing an IEEE-1284 device ID with an empty MDL field, modelptr equals buffer after copying zero model characters, causing the dedup loop at line 1122 to call strncasecmp(buffer, modelptr, 0) which always returns 0 and moverightpart(buffer, bufsize, modelptr, 0) which makes no progress. The loop never terminates and pins one CPU core indefinitely. The function is reachable over the network via cfIEEE1284GetMakeModel() called by cups-browsed on printer-advertised device IDs (IPP/DNS-SD). CWE-835. No upstream fix; PR #139 / commit 7c45e5f addresses an adjacent OOB-read only.

Last updated 8 June 2026

Last updated 8 June 2026

Last updated 8 June 2026

Last updated 8 June 2026

CUPS has an integer underflow in ppdCreateFromIPP causes root cupsd crash via negative job-password-supported

Accounts. A privacy issue was addressed with improved private data redaction for log entries.

cpdb-libs provides frontend and backend libraries for the Common Printing Dialog Backends (CPDB) project. In versions 1.0 through 2.0b4, cpdb-libs is vulnerable to buffer overflows via improper use of scanf(3). cpdb-libs uses the fscanf() and scanf() functions to parse command lines and configuration files, dropping the read string components into fixed-length buffers, but does not limit the length of the strings to be read by fscanf() and scanf() causing buffer overflows when a string is longer than 1023 characters. A patch for this issue is available at commit f181bd1f14757c2ae0f17cc76dc20421a40f30b7. As all buffers have a length of 1024 characters, the patch limits the maximum string length to be read to 1023 by replacing all occurrences of %s with %1023s in all calls of the fscanf() and scanf() functions.

Last updated 8 June 2026

CUPS has a use-after-free in cupsdDeleteTemporaryPrinters via dangling subscription pointer

On 2026-04-08 03:40, Peter Gutmann wrote: Under Ubuntu it's installed by default and deeply embedded into things (some packages can't be removed at all, try a 'sudo apt purge libcups' but whatever you do don't hit 'y') libcups itself is only the client side that does not seem vulnerable to any of the issues, cupsd can be managed like any other daemon, and worst case can be firewalled off if that does not work for whatever reason.

CVE-2026-34980 and CVE-2026-34990

https://heyitsas.im/posts/cups/ discloses: 1. CVE-2026-34980: Shared PostScript queue lets anonymous Print-Job requests reach lp code execution over the network

2. CVE-2026-34990: Local print admin token disclosure using temporary printers

At a high level, in the first vulnerability, the attacker:

1. Submits a malicious print job to a shared PostScript queue, 2. Gets CUPS to treat attacker-controlled text as a trusted queue config by abusing a parsing bug, and 3. Gets code execution as the CUPS service user, lp (vim in the PoC)

And in the second vulnerability, the attacker:

1. Uses any unprivileged local user to set up a localhost listener, 2. Creates a local printer object in CUPS, pointing it at the listener above, 3. Gets CUPS to authenticate to it and captures the auth token, 4. Creates another queue pointing at file:///... for the target rootful write, 5. Uses the token to race against CUPS validation logic’s cleanup of the dangerous queue, and 6. Writes what they want into the target file:///... (/etc/sudoers.d/... in the PoC)

any unprivileged local user that can bind on some TCP port and reach the local CUPS listener.

Are you affected? + Mitigation

The unauth’d RCE as lp (CVE-2026-34980) requires the CUPS server to be reachable over the network and expose a shared PostScript queue (these are legacy, but still used). This would be a deliberate config choice – realistic for, say, networked printing servers in your corporate environment, but not for your desktop (unless you for some reason set it up to be a remote printing server).

The LPE to root file (over)write (CVE-2026-34990), on the other hand, works on the stock CUPS config.

For both issues, the harm can be limited by a security module that confines CUPS (e.g., SELinux, AppArmor, etc.). So, if you run CUPS under a sane security policy (default on some distributions), the impact of both As of 4/5/2026, there are public commits with fixes to both issues but no fixed release (latest being 2.4.16). So, your best mitigations are:

Do not expose CUPS over the network with a shared PostScript queue – or at all If you must use a shared queue, require auth for job submissions to that queue Make sure your CUPS runs under a reasonable AppArmor/SELinux/etc. policy, so that the impact is minimized even if you are targeted Further details, including about how the bugs were found and the PoC can be found in the blog post at https://heyitsas.im/posts/cups/ and the article at https://www.theregister.com/2026/04/06/aiagentscupsserverrce/

The CUPS maintainers have published advisories for the above at:

CVE-2026-34980: https://github.com/OpenPrinting/cups/security/advisories/GHSA-4852-v58g-6cwf

CVE-2026-34990: https://github.com/OpenPrinting/cups/security/advisories/GHSA-c54j-2vqw-wpwp

Additionally, in the past week they've also published advisories for:

CVE-2026-27447: Authorization bypass via case-insensitive group-member lookup https://github.com/OpenPrinting/cups/security/advisories/GHSA-v987-m8hp-phj9

CVE-2026-34978: Path traversal in RSS notify-recipient-uri enables file write outside CacheDir/rss (and clobbering of job.cache) https://github.com/OpenPrinting/cups/security/advisories/GHSA-f53q-7mxp-9gcr

CVE-2026-34979: Heap overflow in getoptions() https://github.com/OpenPrinting/cups/security/advisories/GHSA-6qxf-7jx6-86fh

CVE-2026-39314: Integer underflow in ppdCreateFromIPP causes root cupsd crash via negative job-password-supported https://github.com/OpenPrinting/cups/security/advisories/GHSA-pp8w-2g52-7vj7

CVE-2026-39316: Use-after-free in cupsdDeleteTemporaryPrinters via dangling subscription pointer https://github.com/OpenPrinting/cups/security/advisories/GHSA-pjv5-prqp-46rg

<no CVE>: Out-of-bounds heap read in cupsdSetPrinterAttr marker-types parsing https://github.com/OpenPrinting/cups/security/advisories/GHSA-qfp8-9frx-5j48

-- -Alan Coopersmith- alan.coopersmith () oracle com Oracle Solaris Engineering - https://blogs.oracle.com/solaris

Cupsd Listen arbitrary chmod 0140777

cups-filters contains backends, filters, and other software required to get the cups printing service working on operating systems other than macos. In cups-filters prior to 1.28.18, by crafting a PDF file with a large MediaBox value, an attacker can cause CUPS-Filter 1.x’s pdftoraster tool to write beyond the bounds of an array. First, a PDF with a large MediaBox width value causes header.cupsWidth to become large. Next, the calculation of bytesPerLine = (header.cupsBitsPerPixel header.cupsWidth + 7) / 8 overflows, resulting in a small value. Then, lineBuf is allocated with the small bytesPerLine size. Finally, convertLineChunked calls writePixel8, which attempts to write to lineBuf outside of its buffer size (out of bounds write). In libcupsfilters, the maintainers found the same bytesPerLine multiplication without overflow check, but the provided test case does not cause an overflow there, because the values are different. Commit 50d94ca0f2fa6177613c97c59791bde568631865 contains a patch, which is incorporated into cups-filters version 1.28.18.

CUPS is a standards-based, open-source printing system, and libcupsfilters contains the code of the filters of the former cups-filters package as library functions to be used for the data format conversion tasks needed in Printer Applications. In CUPS-Filters versions up to and including 1.28.17 and libscupsfilters versions 2.0.0 through 2.1.1, CUPS-Filters's imagetoraster filter has an out of bounds read/write vulnerability in the processing of TIFF image files. While the pixel buffer is allocated with the number of pixels times a pre-calculated bytes-per-pixel value, the function which processes these pixels is called with a size of the number of pixels times 3. When suitable inputs are passed, the bytes-per-pixel value can be set to 1 and bytes outside of the buffer bounds get processed. In order to trigger the bug, an attacker must issue a print job with a crafted TIFF file, and pass appropriate print job options to control the bytes-per-pixel value of the output format. They must choose a printer configuration under which the imagetoraster filter or its C-function equivalent cfFilterImageToRaster() gets invoked. The vulnerability exists in both CUPS-Filters 1.x and the successor library libcupsfilters (CUPS-Filters 2.x). In CUPS-Filters 2.x, the vulnerable function is cfImageReadTIFF() in libcupsfilters. When this function is invoked as part of cfFilterImageToRaster(), the caller passes a look-up-table during whose processing the out of bounds memory access happens. In CUPS-Filters 1.x, the equivalent functions are all found in the cups-filters repository, which is not split into subprojects yet, and the vulnerable code is in cupsImageReadTIFF(), which is called through cupsImageOpen() from the imagetoraster tool. A patch is available in commit b69dfacec7f176281782e2f7ac44f04bf9633cfa.

cups-filters contains backends, filters, and other software required to get the cups printing service working on operating systems other than macos. In versions 2.0.1 and prior, a heap-buffer-overflow vulnerability in the rastertopclx filter causes the program to crash with a segmentation fault when processing maliciously crafted input data. This issue can be exploited to trigger memory corruption, potentially leading to arbitrary code execution. This issue has been patched via commit 956283c.

Hi all,

Commits with fixes in the project:

Have a nice day!

Zdenek

-- Zdenek Dohnal Senior Software Engineer Red Hat, BRQ-TPBC

Hi all,

The fix lies in libcupsfilters:

https://github.com/OpenPrinting/cups-filters/commit/50d94ca0f2fa6177613c97c59791bde568631865

and in cups-filters 1.x (which contains libcupsfilters library before 2.x):

https://github.com/OpenPrinting/libcupsfilters/commit/fd01543f372ca3ba1f1c27bd3427110fa0094e3f

The detailed description of vulnerability is present at

https://github.com/OpenPrinting/cups-filters/security/advisories/GHSA-893j-2wr2-wrh9

Have a nice day,

Zdenek Dohnal

-- Zdenek Dohnal Senior Software Engineer Red Hat, BRQ-TPBC

Hi all, - heap-buffer-overflow write in cfImageLut()

- heap-buffer-overflow in cfImageReadTIFF()

- multiple out of bounds reads in cfImageReadTIFF()'s scanline buffer The fixes are present in libcupsfilters project as commits:

https://github.com/OpenPrinting/libcupsfilters/commit/b69dfacec7f17628178 https://github.com/OpenPrinting/cups-filters/commit/5122052dd8f06949242099401c59f6c3b14e61c3

https://github.com/OpenPrinting/cups-filters/commit/cb927006747b797aa9163cd0cbd41b9bbdf05db0

https://github.com/OpenPrinting/cups-filters/commit/719c557c9a29db32b855e6e108d7f4e7c5397613

https://github.com/OpenPrinting/cups-filters/commit/7bd588a1fc5c99ac0b1951beb1b54b438137a7b5

https://github.com/OpenPrinting/cups-filters/commit/5e5f1c5d46a043c57cbbe6e043aa95896d9c40fa

Detailed information about issues are in published advisories:

https://github.com/OpenPrinting/libcupsfilters/security/advisories/GHSA-jpxg-qc2c-hgv4

https://github.com/OpenPrinting/libcupsfilters/security/advisories/GHSA-rc6w-jmvv-v7gx

https://github.com/OpenPrinting/libcupsfilters/security/advisories/GHSA-fmvr-45mx-43c6

Have a nice day!

Zdenek Dohnal

-- Zdenek Dohnal Senior Software Engineer Red Hat, BRQ-TPBC

CUPS is a standards-based, open-source printing system, and cups-browsed contains network printing functionality including, but not limited to, auto-discovering print services and shared printers. cups-browsed binds to INADDRANY:631, causing it to trust any packet from any source, and can cause the Get-Printer-Attributes IPP request to an attacker controlled URL. When combined with other vulnerabilities, such as CVE-2024-47076, CVE-2024-47175, and CVE-2024-47177, an attacker can execute arbitrary commands remotely on the target machine without authentication when a malicious printer is printed to.

Accounts. A permissions issue was addressed with additional restrictions.

CUPS is a standards-based, open-source printing system, and libcupsfilters contains the code of the filters of the former cups-filters package as library functions to be used for the data format conversion tasks needed in Printer Applications. The cfGetPrinterAttributes5 function in libcupsfilters does not sanitize IPP attributes returned from an IPP server. When these IPP attributes are used, for instance, to generate a PPD file, this can lead to attacker controlled data to be provided to the rest of the CUPS system.