Skip to content
OpenAdvisories
Medium · 6.1 Public exploit CVE-2026-34980 EUVD-2026-18887

OpenPrinting CUPS: Shared PostScript queue lets anonymous Print-Job requests reach `lp` code execution over the network

Published Apr 3, 2026 · Updated Apr 6, 2026 · Assigned by GitHub_M

Vendor: OpenPrinting Product: cups Package: cups Package: cups Package: cups Package: cups Ecosystem: Alpine Ecosystem: Azure Linux Ecosystem: Debian Ecosystem: Ubuntu

Description

OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.16 and prior, in a network-exposed cupsd with a shared target queue, an unauthorized client can send a Print-Job to that shared PostScript queue without authentication. The server accepts a page-border value supplied as textWithoutLanguage, preserves an embedded newline through option escaping and reparse, and then reparses the resulting second-line PPD: text as a trusted scheduler control record. A follow-up raw print job can therefore make the server execute an attacker-chosen existing binary such as /usr/bin/vim as lp. At time of publication, there are no publicly available patches.

Affected products

VendorProductAffectedFixed
OpenPrinting cups <= 2.4.16 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 cups 2.4.17-1 —
Debian 13 cups No fix yet —
Debian 12 cups No fix yet —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 26.04 LTS cups 2.4.16-1ubuntu1.2 USN-8405-1
Ubuntu 25.10 cups 2.4.12-0ubuntu3.9 USN-8405-1
Ubuntu 24.04 LTS cups 2.4.7-1.2ubuntu7.13 USN-8405-1
Ubuntu 22.04 LTS cups 2.4.1op1-1ubuntu4.20 USN-8405-1
Show 3 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 20.04 LTS cups No fix yet —
Ubuntu Pro 18.04 LTS cups No fix yet —
Ubuntu Pro 16.04 LTS cups 2.1.3-4ubuntu0.11+esm13 USN-8578-1

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
RHEL 10 cups 1:2.4.10-18.el10_2 RHSA-2026:39302
RHEL 9 cups 1:2.3.3op2-39.el9_8 RHSA-2026:39316
RHEL 8 cups 1:2.2.6-68.el8_10 RHSA-2026:36733
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Red Hat Hardened Images 1 cups +7 2.4.17-1.hum1 RHSA-2026:8814

AlmaLinux

Errata ↗
ReleasePackageFixed inAdvisory
AlmaLinux 10 cups +7 1:2.4.10-18.el10_2 ALSA-2026:39302
AlmaLinux 9 cups +7 1:2.3.3op2-39.el9_8 ALSA-2026:39316
AlmaLinux 8 cups +6 1:2.2.6-68.el8_10 ALSA-2026:36733

Rocky Linux

Errata ↗
ReleasePackageFixed inAdvisory
Rocky Linux 10 cups 1:2.4.10-18.el10_2 RLSA-2026:39302
Rocky Linux 9 cups 1:2.3.3op2-39.el9_8 RLSA-2026:39316
Rocky Linux 8 cups 1:2.2.6-68.el8_10 RLSA-2026:36733

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP7 cups 2.2.7-150000.3.93.1 SUSE-SU-2026:2732-1
SLES 12 SP5 cups 1.7.5-20.62.1 SUSE-SU-2026:2718-1, SUSE-SU-2026:1617-1
Show 4 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLE Micro 5.5 cups 2.2.7-150000.3.93.1 SUSE-SU-2026:2732-1
SLE Micro 5.4 cups 2.2.7-150000.3.93.1 SUSE-SU-2026:2732-1
SLE Micro 5.3 cups 2.2.7-150000.3.93.1 SUSE-SU-2026:2732-1
SLE Micro 5.2 cups 2.2.7-150000.3.93.1 SUSE-SU-2026:2732-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed cups 2.4.17-1.1 openSUSE-SU-2026:10589-1

Alpine

Security tracker ↗
ReleasePackageFixed inAdvisory
Alpine v3.24 cups 2.4.18-r0 —
Alpine v3.23 cups 2.4.18-r0 —
Alpine v3.22 cups 2.4.18-r0 —
Alpine v3.21 cups 2.4.18-r0 —
Alpine v3.20 cups 2.4.18-r0 —

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 cups +7 1:2.4.16-1.amzn2023.0.3 ALAS2023-2026-1635
Amazon Linux 2 cups +6 1:1.6.3-51.amzn2.0.9 ALAS2-2026-3279

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 cups 2.4.17-1 —

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 10 cups +7 1:2.4.10-18.el10_2 ELSA-2026-39302
Oracle Linux 9 cups +7 1:2.3.3op2-39.el9_8 ELSA-2026-39316
Oracle Linux 8 cups +6 1:2.2.6-68.el8_10 ELSA-2026-36733

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Advisories 22

References