OpenPrinting CUPS CVE-2026-107655

Exploitation requires: (1) a running cupsd with a shared printer queue reachable by the attacker and configured to accept job submissions without authentication; (2) a vulnerable CUPS version that still includes the deprecated embedded job-ticket comment feature (removed in the fix); and (3) submission of a single PostScript or PDF file through the Print-Job operation whose first lines contain a %cupsJobTicket: comment carrying the specific malformed IPP attributes that trigger the null dereference. Limiting factors: the embedded-ticket path only fires for single-file Print-Job of PS/PDF (not Create-Job + Send-File), the queue must be reachable and permit the attacker's submissions, and impact is bounded to a temporary daemon crash (DoS) with automatic restart - no code execution, no data access.

This is a low-to-moderate real-world priority despite affecting a ubiquitous component. The impact is confined to availability: a CWE-476 null pointer dereference that crashes cupsd, causing a TEMPORARY Denial of Service for printing - no confidentiality or integrity impact (C:N/I:N/A:L), and cupsd is typically restarted by the service manager, so the outage is transient rather than persistent. Key signals CONFLICT and must be verified: the provided CVSS vector asserts AV:L (local) at base score 4.0, but the description explicitly states an unauthenticated attacker sends a crafted IPP request to a shared printer queue - IPP is a network protocol (TCP/631), which implies AV:N or AV:A, not AV:L. This discrepancy materially changes exposure and should be confirmed with Red Hat. No EPSS probability was supplied, the CVE is NOT in CISA KEV, and no public exploit was provided (the GitHub links are vendor fix commits, not exploit code). With no active-exploitation or weaponization signal, an availability-only temporary DoS, and a modest CVSS, this ranks as routine-patch priority rather than emergency - though its wide deployment footprint warrants timely patching on internet- or multi-tenant-exposed print servers.

An attacker able to reach a shared CUPS print queue submits a PostScript or PDF file via the Print-Job operation containing a crafted %cupsJobTicket comment with specific malformed IPP attributes. When cupsd parses the embedded job ticket, it dereferences a null pointer and crashes, halting all printing services until the daemon restarts. No public exploit was identified at time of analysis; only vendor fix commits are available.