OpenPrinting vulnerabilities

Products

• cups 26
• cups-filters 4
• libcupsfilters 3
• libppd 2
• cpdb-libs 1
• cups-browsed 1
• ippusbxd 1
• ippusbxd firmware 1
• pappl-retrofit 1

Latest OpenPrinting CVEs

Newest publication first · page 1 of 2

1. CVE-2026-123747 Pappl-retrofit: directory traversal in the add-ppdfiles and delete-ppdfiles actions

   Published 2026-11-11

   High·CVSS 7.3 EPSS 1.2%

   A flaw was found in pappl-retrofit. The application fails to properly sanitize user-supplied filenames when handling the upload and deletion of PostScript Printer Description (PPD) files. A remote, unauthenticated attacker can exploit this directory traversal flaw by submitting f...

2. CVE-2026-61702 OpenPrinting CUPS: root-side banner file disclosure

   Published 2026-10-15

   Medium·CVSS 5.3 EPSS 0.42%

   OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, copy_banner() in scheduler/ipp.c uses the attacker-controlled IPP attributes-natural-language value as a directory component beneath DataDir/banners when processi...

3. CVE-2026-55453 CUPS ipp backend status-line injection can update queue PPD and lead to conditional RCE as lp via foomatic-rip

   Published 2026-10-15

   Low·CVSS 3.3 EPSS 0.19%

   OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, the backend/ipp.c quote_string() function preserves carriage-return and line-feed characters in a remote printer-controlled marker-message before report_attr() wr...

4. CVE-2026-55480 CUPS copy_model() creates a predictable PPD tempfile without O_EXCL/O_NOFOLLOW (symlink TOCTOU, lp → root)

   Published 2026-10-15

   Medium·CVSS 5.7 EPSS 0.20%

   OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, copy_model() in scheduler/ipp.c creates a predictable TempDir/<connection-number>.ppd path in an lp-group-writable directory and opens it as root without O_EXCL o...

5. CVE-2026-55467 CUPS fax option values bypass the CVE-2026-34980 control-character sanitizer (incomplete fix)

   Published 2026-10-15

   Low·CVSS 2.5 EPSS 0.18%

   OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, the cupsdCreateJob option-string builder in scheduler/job.c maps attacker-controlled destination-uri and pre-dial-string values from a configured fax queue to the...

6. CVE-2026-107890 OpenPrinting CUPS before 2.4.20 contains a NULL pointer dereference caused by repeated IPP group tags in job-creation requests. IPP parsing creates unnamed separator attributes with IPP_TAG_ZERO, but...

   Published 2026-10-09

   Medium·CVSS 5.5 EPSS 0.15%

   OpenPrinting CUPS before 2.4.20 contains a NULL pointer dereference caused by repeated IPP group tags in job-creation requests. IPP parsing creates unnamed separator attributes with IPP_TAG_ZERO, but add_job() converts these separators to IPP_TAG_JOB. During job startup, get_opti...

7. CVE-2026-107888 OpenPrinting CUPS before 2.4.20 contains a NULL pointer dereference in cupsdCheckJobs() when a job marked job-held-on-create refers to a temporary printer that has been automatically deleted. Temporar...

   Published 2026-10-09

   Medium·CVSS 5.5 EPSS 0.13%

   OpenPrinting CUPS before 2.4.20 contains a NULL pointer dereference in cupsdCheckJobs() when a job marked job-held-on-create refers to a temporary printer that has been automatically deleted. Temporary-printer cleanup can remove the destination without canceling its held jobs, an...

8. CVE-2026-107886 OpenPrinting CUPS before 2.4.20 contains a double-free in printer-class management. When CUPS-Add-Modify-Class replaces an existing class member list, add_class() frees pclass->printers without cleari...

   Published 2026-10-09

   Medium·CVSS 6.5 EPSS 0.24%

   OpenPrinting CUPS before 2.4.20 contains a double-free in printer-class management. When CUPS-Add-Modify-Class replaces an existing class member list, add_class() frees pclass->printers without clearing the pointer. If subsequent validation fails, the class retains the dangling p...

9. CVE-2026-107885 OpenPrinting CUPS through 2.4.20 contains a resource-exhaustion vulnerability in the submission-timeout handling of cupsdCheckJobs(). The scheduler suppresses timeout processing for all pending jobs w...

   Published 2026-10-09

   Medium·CVSS 5.5 EPSS 0.15%

   OpenPrinting CUPS through 2.4.20 contains a resource-exhaustion vulnerability in the submission-timeout handling of cupsdCheckJobs(). The scheduler suppresses timeout processing for all pending jobs whenever any client connection has an in-flight Send-Document operation, without...

10. CVE-2026-41079 OpenPrinting CUPS: Heap out-of-bounds read in SNMP supply-level polling leaks stack memory to authenticated users

    Published 2026-04-24

    Medium·CVSS 5.4 EPSS 0.41%

    OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.17, a network-adjacent attacker can send a crafted SNMP response to the CUPS SNMP backend that causes an out-of-bounds read of up to 176 bytes past a stack buffer. Th...

11. CVE-2026-39316 CUPS has a use-after-free in `cupsdDeleteTemporaryPrinters` via dangling subscription pointer

    Published 2026-04-07

    Medium·CVSS 6.2 EPSS 0.18%

    OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.16 and prior, a use-after-free vulnerability exists in the CUPS scheduler (cupsd) when temporary printers are automatically deleted. cupsdDeleteTemporaryPrinters()...

12. CVE-2026-39314 CUPS has an integer underflow in `_ppdCreateFromIPP` causes root cupsd crash via negative `job-password-supported`

    Published 2026-04-07

    Medium·CVSS 6.2 EPSS 0.16%

    OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.16 and prior, an integer underflow vulnerability in _ppdCreateFromIPP() (cups/ppd-cache.c) allows any unprivileged local user to crash the cupsd root process by su...

13. CVE-2026-34980 OpenPrinting CUPS: Shared PostScript queue lets anonymous Print-Job requests reach `lp` code execution over the network

    Published 2026-04-03

    Medium·CVSS 6.1 EPSS 1.7%

    OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.16 and prior, in a network-exposed cupsd with a shared target queue, an unauthorized client can send a Print-Job to that shared PostScript queue without authentica...

14. CVE-2026-34979 OpenPrinting CUPS: Heap overflow in `get_options()`

    Published 2026-04-03

    Medium·CVSS 5.3 EPSS 0.41%

    OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.16 and prior, there is a heap-based buffer overflow in the CUPS scheduler when building filter option strings from job attribute. At time of publication, there are...

15. CVE-2026-34978 OpenPrinting CUPS: Path traversal in RSS notify-recipient-uri enables file write outside CacheDir/rss (and clobbering of job.cache)

    Published 2026-04-03

    Medium·CVSS 6.5 EPSS 0.42%

    OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.16 and prior, the RSS notifier allows .. path traversal in notify-recipient-uri (e.g., rss:///../job.cache), letting a remote IPP client write RSS XML bytes outsid...

16. CVE-2026-34990 OpenPrinting CUPS: Local print admin token disclosure using temporary printers

    Published 2026-04-03

    Medium·CVSS 5.0 EPSS 0.30%

    OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.16 and prior, a local unprivileged user can coerce cupsd into authenticating to an attacker-controlled localhost IPP service with a reusable Authorization: Local ....

17. CVE-2026-27447 OpenPrinting CUPS: Authorization bypass via case-insensitive group-member lookup

    Published 2026-04-03

    Medium·CVSS 6.3 EPSS 0.30%

    OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.16 and prior, CUPS daemon (cupsd) contains an authorization bypass vulnerability due to case-insensitive username comparison during authorization checks. The vulne...

18. CVE-2025-58436 OpenPrinting CUPS slow client can halt cupsd, leading to a possible DoS attack

    Published 2025-11-29

    Medium·CVSS 5.5 EPSS 0.25%

    OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to version 2.4.15, a client that connects to cupsd but sends slow messages, e.g. only one byte per second, delays cupsd as a whole, such that it becomes unusable by other cl...

19. CVE-2025-61915 OpenPrinting CUPS vulnerable to stack based out-of-bound write

    Published 2025-11-29

    Medium·CVSS 6.7 EPSS 0.50%

    OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to version 2.4.15, a user in the lpadmin group can use the cups web ui to change the config and insert a malicious line. Then the cupsd process which runs as root will parse...

20. CVE-2025-64524 CUPS rastertopclx Filter Vulnerable to Heap Buffer Overflow Leading to Potential Arbitrary Code Execution

    Published 2025-11-20

    Medium·CVSS 5.5 EPSS 0.22%

    cups-filters contains backends, filters, and other software required to get the cups printing service working on operating systems other than macos. In versions 2.0.1 and prior, a heap-buffer-overflow vulnerability in the rastertopclx filter causes the program to crash with a seg...

21. CVE-2025-64503 [BIGSLEEP-434615384] cups-filters 1.x: out of bounds write in pdftoraster

    Published 2025-11-12

    Low·CVSS 3.3 EPSS 0.23%

    cups-filters contains backends, filters, and other software required to get the cups printing service working on operating systems other than macos. In cups-filters prior to 1.28.18, by crafting a PDF file with a large MediaBox value, an attacker can cause CUPS-Filter 1.x’s pdfto...

22. CVE-2025-57812 [BIGSLEEP-434612419] CUPS-Filters has heap-buffer-overflow write in `cfImageLut()`

    Published 2025-11-12

    Low·CVSS 3.7 EPSS 0.48%

    CUPS is a standards-based, open-source printing system, and libcupsfilters contains the code of the filters of the former cups-filters package as library functions to be used for the data format conversion tasks needed in Printer Applications. In CUPS-Filters versions up to and i...

23. CVE-2025-58364 cups: Remote DoS via null dereference

    Published 2025-09-11

    Medium·CVSS 6.5 EPSS 1.1%

    OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.12 and earlier, an unsafe deserialization and validation of printer attributes causes null dereference in the libcups library. This is a remote DoS vulnerability a...

24. CVE-2025-58060 cups has Authentication bypass with AuthType Negotiate

    Published 2025-09-11

    High·CVSS 8.0 EPSS 0.98%

    OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.12 and earlier, when the AuthType is set to anything but Basic, if the request contains an Authorization: Basic ... header, the password is not checked. This resul...

25. CVE-2024-45062 A stack based buffer overflow vulnerability is present in OpenPrinting ippusbxd 1.34. A specially configured printer that supports IPP-over-USB can cause a buffer overflow which can lead to a arbitrar...

    Published 2025-08-19

    Medium·CVSS 6.8 EPSS 0.38%

    A stack based buffer overflow vulnerability is present in OpenPrinting ippusbxd 1.34. A specially configured printer that supports IPP-over-USB can cause a buffer overflow which can lead to a arbitrary code execution in a privileged service. To trigger the vulnerability, a malici...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.