CVE-2026-107885

In OpenPrinting CUPS, versions 2.4.16 and prior, a use-after-free vulnerability exists in the CUPS scheduler (cupsd) when temporary printers are automatically deleted.

OpenPrinting CUPS before version 2.4.20 has a flaw in copy_banner() that uses the attacker-controlled attributes-natural-language value as a directory component. This allows escaping the banner directory and copying an arbitrary file into a spool object that can be delivered to the attacker.

In OpenPrinting CUPS, copy_model() in scheduler/ipp.c creates a predictable TempDir/<connection-number>.ppd path in an lp-group-writable directory and opens it as root without O_EXCL or O_NOFOLLOW. Exploitation requires an lp-group process able to write that directory, predict the connection-derived name, and plant a symlink before the root open, while a privileged add-printer or modify-printer operation using a model PPD triggers copy_model(). Fixed in version 2.4.20.

In OpenPrinting CUPS before 2.4.20, the cupsdCreateJob option-string builder in scheduler/job.c maps attacker-controlled destination-uri and pre-dial-string values from a configured fax queue to the phone and faxPrefix options. These mapped fax values bypass the control-character sanitizer and are copied directly into the filter options argument, allowing a user permitted to submit a job to inject control characters into the downstream option stream.

In OpenPrinting CUPS before 2.4.20, the quote_string() function in backend/ipp.c preserves carriage-return and line-feed characters in a remote printer-controlled marker-message before report_attr() writes the value to the scheduler status stream. The scheduler can parse an injected newline as a separate PPD control line and persist an attacker-selected PPD keyword.

A NULL pointer dereference in OpenPrinting CUPS before 2.4.20 caused by repeated IPP group tags in job-creation requests. IPP parsing creates unnamed separator attributes with IPP_TAG_ZERO, but add_job() converts these separators to IPP_TAG_JOB. During job startup, get_options()/ipp_length() calls strlen() on a NULL attribute name, terminating cupsd and disrupting all queues.

A NULL pointer dereference in cupsdCheckJobs() in OpenPrinting CUPS before 2.4.20 when a job marked job-held-on-create refers to a temporary printer that has been automatically deleted. Temporary-printer cleanup can remove the destination without canceling its held jobs, and the scheduler dereferences the NULL result of cupsdFindDest() while checking holding_new_jobs. This terminates cupsd and interrupts all queues.

A double-free in printer-class management in OpenPrinting CUPS before 2.4.20. When CUPS-Add-Modify-Class replaces an existing class member list, add_class() frees pclass->printers without clearing the pointer. If subsequent validation fails, the class retains the dangling pointer; CUPS-Delete-Class subsequently frees the same allocation in cupsdDeletePrinter(). A client authorized to modify and delete classes can cause scheduler-wide denial of service.

In OpenPrinting CUPS before version 2.4.15, a user in the lpadmin group can use the web UI to change the config and insert a malicious line. The cupsd process running as root parses the new config, causing an out-of-bounds write.

OpenPrinting CUPS before version 2.4.15 is vulnerable to a slowloris-style attack. A client sending very slow messages (e.g. one byte per second) blocks cupsd, preventing other clients from being served.