Skip to content
OpenAdvisories
Medium USN-8578-1 1 CVE

CUPS vulnerability

Published Jul 21, 2026 · Updated Jul 21, 2026

Ecosystem: Ubuntu

Summary

It was discovered that CUPS did not properly filter control characters in IPP string attributes and PPD keywords. An unauthenticated attacker could exploit this to execute arbitrary code as the lp user on systems with shared target queues.

Fixed packages 1

ReleasePackageFixed in
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS cups 2.1.3-4ubuntu0.11+esm13

Vulnerabilities 1

  • Medium 6.1
    CVE-2026-34980 Public exploit

    OpenPrinting CUPS: Shared PostScript queue lets anonymous Print-Job requests reach `lp` code execution over the network

    OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.16 and prior, in a network-exposed cupsd with a shared target queue, an unauthorized client can send a Print-Job to that shared PostScript que…

    OpenPrinting cups cups cups Debian Ubuntu Azure Linux Alpine

References

  • report
    https://ubuntu.com/security/CVE-2026-34980