OpenPrinting CUPS CVE-2026-107886

Exploitation requires an actor authorized to both modify and delete printer classes; under CUPS's default policy this means @SYSTEM (administrative) privileges, which is the primary limiting factor. The specific trigger is a CUPS-Add-Modify-Class operation that replaces an existing class's member list and then fails subsequent validation (leaving pclass->printers as a dangling pointer), followed by a CUPS-Delete-Class operation that frees the same allocation a second time in cupsdDeletePrinter(). Impact is limited to denial of service (scheduler crash); there is no confidentiality or integrity effect. Only CUPS versions before 2.4.20 are affected. No special non-default configuration is needed beyond having class-management authorization, though whether the attack is reachable remotely depends on the CUPS listener/access configuration.

This is a genuinely low-priority issue whose signals are internally consistent. The provided CVSS of 2.3 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L) correctly reflects a denial-of-service-only impact (A:L, with C:N/I:N) gated behind high privileges (PR:H) - matching the description's explicit statement that the default policy requires @SYSTEM privileges to modify and delete printer classes. There is no EPSS score, no CISA KEV listing, and no public exploit code referenced, so exploitation probability signals are all absent or negative; the only reference is the vendor GHSA advisory. One signal conflict must be verified: the input CVSS encodes AV:L (local), yet the description describes 'a client authorized to modify and delete classes' issuing CUPS-Add-Modify-Class and CUPS-Delete-Class operations, which are IPP requests that CUPS can service over the network - verify with the vendor whether the attack surface is truly local-only or network-reachable, as this materially changes the attack vector. Even under the broader network interpretation, the @SYSTEM privilege requirement and availability-only impact keep real-world risk low: an attacker who already holds CUPS administrative rights can crash the scheduler, which is a self-inflicted or insider/post-compromise scenario rather than a remotely-weaponizable flaw. No SSVC decision data was provided. Net: a high-prevalence product but a low-severity, high-privilege DoS - patch in normal maintenance cycles, not an emergency.

An attacker who already holds CUPS class-administration rights (@SYSTEM under the default policy) sends a CUPS-Add-Modify-Class request that replaces an existing class's member list but is crafted so subsequent validation fails, leaving a dangling pointer. The attacker then issues CUPS-Delete-Class, triggering a double-free in cupsdDeletePrinter() that crashes the scheduler and halts all printing service-wide. No public exploit code was identified at time of analysis.