p PatchFirst

PatchFirst · Latest vulnerabilities

cups vulnerabilities

Vulnerabilities published for cups in the last 30 days: 0. Listed in the KEV catalogue: 0.

RSS ↗ JSON ↗
Filter vulnerabilities
Clear filters

Vulnerabilities: 11

  1. USN-8405-2

    Not ratedFix available

    cups regression

    USN-8405-1 fixed vulnerabilities in CUPS. The update introduced a regression that cause CUPS to crash when parsing certain large printer PPD files. This update fixes the problem. Original advisory details: Ariel Silver discovered that CUPS incorrectly handled username comparisons during authorization checks. A local attacker could possibly use this issue to gain unauthorized access to restricted operations. (CVE-2026-27447) Asim Viladi Oglu Manizada discovered that CUPS incorrectly handled notify-recipient-uri values in the RSS notifier. A remote attacker could possibly use this issue to overwrite lp-writable files and cause a denial

    cupsOperating systems
    • Update to 2.4.12-0ubuntu3.10
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  2. CVE-2026-41079

    Medium · CVSS 4.3EPSS 0.41%Fix available

    OpenPrinting CUPS: Heap out-of-bounds read in SNMP supply-level polling leaks stack memory to authenticated users

    OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.17, a network-adjacent attacker can send a crafted SNMP response to the CUPS SNMP backend that causes an out-of-bounds read of up to 176 bytes past a stack buffer. The leaked memory is converted from UTF-16 to UTF-8 and stored as printer supply description strings, which are subsequently visible to authenticated users via IPP Get-Printer-Attributes responses and the CUPS web interface. This vulnerability is fixed in 2.4.17.

    cupsOperating systems
    • Update to 2.4.12-0ubuntu3.9
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  3. CVE-2026-39316

    Medium · CVSS 4EPSS 0.18%Fix available

    CUPS has a use-after-free in `cupsdDeleteTemporaryPrinters` via dangling subscription pointer

    OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.16 and prior, a use-after-free vulnerability exists in the CUPS scheduler (cupsd) when temporary printers are automatically deleted. cupsdDeleteTemporaryPrinters() in scheduler/printers.c calls cupsdDeletePrinter() without first expiring subscriptions that reference the printer, leaving cupsd_subscription_t.dest as a dangling pointer to freed heap memory. The dangling pointer is subsequently dereferenced at multiple code sites, causing a crash (denial of service) of the cupsd daemon. With heap grooming, this can be leveraged fo

    cupsOperating systems
    • Update to 2.4.12-0ubuntu3.9
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  4. CVE-2026-39314

    Medium · CVSS 4EPSS 0.16%Fix available

    CUPS has an integer underflow in `_ppdCreateFromIPP` causes root cupsd crash via negative `job-password-supported`

    OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.16 and prior, an integer underflow vulnerability in _ppdCreateFromIPP() (cups/ppd-cache.c) allows any unprivileged local user to crash the cupsd root process by supplying a negative job-password-supported IPP attribute. The bounds check only caps the upper bound, so a negative value passes validation, is cast to size_t (wrapping to ~2^64), and is used as the length argument to memset() on a 33-byte stack buffer. This causes an immediate SIGSEGV in the cupsd root process. Combined with systemd's Restart=on-failure, an attacker c

    cupsOperating systems
    • Update to 2.4.12-0ubuntu3.9
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  5. CVE-2026-34980

    Medium · CVSS 6.1EPSS 0.34%Fix available

    OpenPrinting CUPS: Shared PostScript queue lets anonymous Print-Job requests reach `lp` code execution over the network

    OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.16 and prior, in a network-exposed cupsd with a shared target queue, an unauthorized client can send a Print-Job to that shared PostScript queue without authentication. The server accepts a page-border value supplied as textWithoutLanguage, preserves an embedded newline through option escaping and reparse, and then reparses the resulting second-line PPD: text as a trusted scheduler control record. A follow-up raw print job can therefore make the server execute an attacker-chosen existing binary such as /usr/bin/vim as lp. At ti

    cupsOperating systems
    • Update to 2.4.12-0ubuntu3.9
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  6. CVE-2026-34979

    Medium · CVSS 5.3EPSS 0.41%Fix available

    OpenPrinting CUPS: Heap overflow in `get_options()`

    OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.16 and prior, there is a heap-based buffer overflow in the CUPS scheduler when building filter option strings from job attribute. At time of publication, there are no publicly available patches.

    cupsOperating systems
    • Update to 2.4.12-0ubuntu3.9
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  7. CVE-2026-34978

    Medium · CVSS 6.5EPSS 0.42%Fix available

    OpenPrinting CUPS: Path traversal in RSS notify-recipient-uri enables file write outside CacheDir/rss (and clobbering of job.cache)

    OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.16 and prior, the RSS notifier allows .. path traversal in notify-recipient-uri (e.g., rss:///../job.cache), letting a remote IPP client write RSS XML bytes outside CacheDir/rss (anywhere that is lp-writable). In particular, because CacheDir is group-writable by default (typically root:lp and mode 0770), the notifier (running as lp) can replace root-managed state files via temp-file + rename(). This PoC clobbers CacheDir/job.cache with RSS XML, and after restarting cupsd the scheduler fails to parse the job cache and previously

    cupsOperating systems
    • Update to 2.4.12-0ubuntu3.9
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  8. CVE-2026-34990

    Medium · CVSS 5EPSS 0.18%Public exploitFix available

    OpenPrinting CUPS: Local print admin token disclosure using temporary printers

    OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.16 and prior, a local unprivileged user can coerce cupsd into authenticating to an attacker-controlled localhost IPP service with a reusable Authorization: Local ... token. That token is enough to drive /admin/ requests on localhost, and the attacker can combine CUPS-Create-Local-Printer with printer-is-shared=true to persist a file:///... queue even though the normal FileDevice policy rejects such URIs. Printing to that queue gives an arbitrary root file overwrite; the PoC below uses that primitive to drop a sudoers fragment a

    cupsOperating systems
    • Update to 2.4.12-0ubuntu3.9
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  9. CVE-2026-27447

    Medium · CVSS 4.8EPSS 0.26%Fix available

    OpenPrinting CUPS: Authorization bypass via case-insensitive group-member lookup

    OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.16 and prior, CUPS daemon (cupsd) contains an authorization bypass vulnerability due to case-insensitive username comparison during authorization checks. The vulnerability allows an unprivileged user to gain unauthorized access to restricted operations by using a user with a username that differs only in case from an authorized user. At time of publication, there are no publicly available patches.

    cupsOperating systems
    • Update to 2.4.12-0ubuntu3.9
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  10. CVE-2025-58436

    Medium · CVSS 5.1EPSS 0.23%Fix available

    OpenPrinting CUPS slow client can halt cupsd, leading to a possible DoS attack

    OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to version 2.4.15, a client that connects to cupsd but sends slow messages, e.g. only one byte per second, delays cupsd as a whole, such that it becomes unusable by other clients. This issue has been patched in version 2.4.15.

    cupsOperating systems
    • Update to 2.4.12-0ubuntu3.5
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  11. CVE-2025-61915

    Medium · CVSS 6EPSS 0.46%Fix available

    OpenPrinting CUPS vulnerable to stack based out-of-bound write

    OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to version 2.4.15, a user in the lpadmin group can use the cups web ui to change the config and insert a malicious line. Then the cupsd process which runs as root will parse the new config and cause an out-of-bound write. This issue has been patched in version 2.4.15.

    cupsOperating systems
    • Update to 2.4.12-0ubuntu3.3
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →