Skip to content
OpenAdvisories
Medium USN-8405-1 8 CVEs

cups vulnerabilities

Published Jun 8, 2026 · Updated Jun 8, 2026

Ecosystem: Ubuntu

Summary

Ariel Silver discovered that CUPS incorrectly handled username comparisons
during authorization checks. A local attacker could possibly use this issue
to gain unauthorized access to restricted operations. (CVE-2026-27447)

Asim Viladi Oglu Manizada discovered that CUPS incorrectly handled
notify-recipient-uri values in the RSS notifier. A remote attacker could
possibly use this issue to overwrite lp-writable files and cause a denial
of service. (CVE-2026-34978)

Jacob Newman discovered that CUPS incorrectly handled filter option strings
when processing job attributes. An attacker could use this issue to cause
CUPS to crash, resulting in a denial of service, or possibly execute
arbitrary code. (CVE-2026-34979)

Asim Viladi Oglu Manizada discovered that CUPS incorrectly handled
page-border values in shared PostScript queues. A remote attacker could
possibly use this issue to execute arbitrary code. (CVE-2026-34980)

Asim Viladi Oglu Manizada discovered that CUPS incorrectly handled
localhost authentication to attacker-controlled IPP services. A local
attacker could possibly use this issue to overwrite arbitrary files
and execute arbitrary code. (CVE-2026-34990)

Tomer Fichman discovered that CUPS incorrectly handled negative
job-password-supported values. A local attacker could possibly use this
issue to cause CUPS to crash, resulting in a denial of service.
(CVE-2026-39314)

Tomer Fichman discovered that CUPS incorrectly handled temporary printer
deletion. An attacker could possibly use this issue to cause CUPS to crash,
resulting in a denial of service, or to execute arbitrary code.
(CVE-2026-39316)

Tomer Fichman discovered that CUPS incorrectly handled certain malformed
SNMP responses. An attacker could possibly use this issue to obtain
sensitive information. (CVE-2026-41079)

Fixed packages 4

ReleasePackageFixed in
Ubuntu · 22.04 LTS 22.04:LTS cups 2.4.1op1-1ubuntu4.20
Ubuntu · 24.04 LTS 24.04:LTS cups 2.4.7-1.2ubuntu7.13
Ubuntu · 25.10 cups 2.4.12-0ubuntu3.9
Ubuntu · 26.04 LTS 26.04:LTS cups 2.4.16-1ubuntu1.2

Vulnerabilities 8

  • Medium 6.5
    CVE-2026-34978

    OpenPrinting CUPS: Path traversal in RSS notify-recipient-uri enables file write outside CacheDir/rss (and clobbering of job.cache)

    OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.16 and prior, the RSS notifier allows .. path traversal in notify-recipient-uri (e.g., rss:///../job.cache), letting a remote IPP client write…

    OpenPrinting cups cups cups Debian Ubuntu Azure Linux Alpine
  • Medium 6.1
    CVE-2026-34980 Public exploit

    OpenPrinting CUPS: Shared PostScript queue lets anonymous Print-Job requests reach `lp` code execution over the network

    OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.16 and prior, in a network-exposed cupsd with a shared target queue, an unauthorized client can send a Print-Job to that shared PostScript que…

    OpenPrinting cups cups cups Debian Ubuntu Azure Linux Alpine
  • Medium 5.3
    CVE-2026-34979

    OpenPrinting CUPS: Heap overflow in `get_options()`

    OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.16 and prior, there is a heap-based buffer overflow in the CUPS scheduler when building filter option strings from job attribute. At time of p…

    OpenPrinting cups cups cups Debian Ubuntu Azure Linux Alpine
  • Medium 5.0
    CVE-2026-34990 Public exploit

    OpenPrinting CUPS: Local print admin token disclosure using temporary printers

    OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.16 and prior, a local unprivileged user can coerce cupsd into authenticating to an attacker-controlled localhost IPP service with a reusable A…

    OpenPrinting cups cups cups Debian Ubuntu Azure Linux Alpine
  • Medium 4.8
    CVE-2026-27447

    OpenPrinting CUPS: Authorization bypass via case-insensitive group-member lookup

    OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.16 and prior, CUPS daemon (cupsd) contains an authorization bypass vulnerability due to case-insensitive username comparison during authorizat…

    OpenPrinting cups cups cups Debian Ubuntu Azure Linux Alpine
  • Medium 4.3
    CVE-2026-41079

    OpenPrinting CUPS: Heap out-of-bounds read in SNMP supply-level polling leaks stack memory to authenticated users

    OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.17, a network-adjacent attacker can send a crafted SNMP response to the CUPS SNMP backend that causes an out-of-bounds read of up to 176 bytes pa…

    OpenPrinting cups cups cups Debian Ubuntu Azure Linux
  • Medium 4.0
    CVE-2026-39314

    CUPS has an integer underflow in `_ppdCreateFromIPP` causes root cupsd crash via negative `job-password-supported`

    OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.16 and prior, an integer underflow vulnerability in _ppdCreateFromIPP() (cups/ppd-cache.c) allows any unprivileged local user to crash the cup…

    OpenPrinting cups cups cups Debian Ubuntu Azure Linux Alpine
  • Medium 4.0
    CVE-2026-39316

    CUPS has a use-after-free in `cupsdDeleteTemporaryPrinters` via dangling subscription pointer

    OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.16 and prior, a use-after-free vulnerability exists in the CUPS scheduler (cupsd) when temporary printers are automatically deleted. cupsdDele…

    OpenPrinting cups cups cups Debian Ubuntu Azure Linux Alpine

References

  • report
    https://ubuntu.com/security/CVE-2026-27447
  • report
    https://ubuntu.com/security/CVE-2026-34978
  • report
    https://ubuntu.com/security/CVE-2026-34979
  • report
    https://ubuntu.com/security/CVE-2026-34980
  • report
    https://ubuntu.com/security/CVE-2026-34990
  • report
    https://ubuntu.com/security/CVE-2026-39314
  • report
    https://ubuntu.com/security/CVE-2026-39316
  • report
    https://ubuntu.com/security/CVE-2026-41079