OpenPrinting CUPS CVE-2026-107890

Exploitation requires that cupsd be reachable by the attacker and that a target queue be enabled, accepting jobs, and support the submitted document format; the attacker must be able to send a Print-Job IPP request carrying repeated IPP group tags. Anonymous (unauthenticated) submission is only possible when the listener and access-control configuration explicitly permit it - otherwise valid credentials/authorization to submit jobs are needed, which is the primary limiting factor. Default CUPS deployments frequently bind only to the local loopback interface, which restricts reachability to local users unless remote listening and sharing have been enabled, further limiting realistic remote exposure.

This is a low-severity denial-of-service issue and does not represent an urgent priority for most environments. The provided CVSS base score is 3.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L), reflecting no confidentiality or integrity impact and only limited availability loss. There is no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score was supplied in the input, so there is no signal of active or probable exploitation. One signal conflict must be stated explicitly: the input CVSS vector is AV:L (local) with PR:L, yet the description repeatedly frames the attack in network terms - 'when the client can reach the scheduler' and 'anonymous submission is possible when permitted by listener and access-control configuration' - which implies that a network-reachable, permissively configured cupsd could be hit remotely and even unauthenticated. The AV:L/PR:L scoring is therefore likely conservative and may understate exposure for internet- or LAN-reachable instances; verify the intended attack vector against the GHSA advisory. Even so, the impact is a recoverable service crash (cupsd terminates, interrupting all print queues until restart) rather than code execution or data exposure, so real-world risk is modest and bounded to printing availability.

An attacker who can submit print jobs to a reachable, enabled, accepting CUPS queue sends a single crafted IPP Print-Job request containing repeated IPP group tags. During job startup cupsd dereferences a NULL attribute name and crashes, taking down all print queues on the host until the service is restarted. No public proof-of-concept exploit was identified at time of analysis, and exploitation requires the ability to reach and submit to the scheduler.