Skip to main content

Cups CVE-2026-34979

| EUVDEUVD-2026-18885 MEDIUM
Heap-based Buffer Overflow (CWE-122)
2026-04-03 GitHub_M
Buffer Overflow Heap Overflow Cups Openprinting
5.3
CVSS 3.1 · Vendor: GitHub_M
Share

Severity by source

Vendor (GitHub_M) PRIMARY
5.3 MEDIUM
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
SUSE
MEDIUM
qualitative
Red Hat
5.3 MEDIUM
qualitative

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
Low

Lifecycle Timeline

3
EUVD ID Assigned
Apr 03, 2026 - 21:30 euvd
EUVD-2026-18885
Analysis Generated
Apr 03, 2026 - 21:30 vuln.today
CVE Published
Apr 03, 2026 - 21:16 nvd
MEDIUM 5.3

DescriptionCVE.org

OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.16 and prior, there is a heap-based buffer overflow in the CUPS scheduler when building filter option strings from job attribute. At time of publication, there are no publicly available patches.

AnalysisAI

Heap-based buffer overflow in OpenPrinting CUPS scheduler versions 2.4.16 and prior allows unauthenticated remote attackers to trigger a denial of service condition by crafting malicious job attributes that overflow buffers during filter option string construction. With a CVSS score of 5.3 and network accessibility, this vulnerability impacts availability on exposed CUPS instances; no public exploit code or vendor patch has been released as of publication.

Technical ContextAI

OpenPrinting CUPS is the standard printing system for Linux and Unix-like environments. The vulnerability exists in the scheduler component's filter option string builder, which processes job attributes without proper bounds checking when constructing filter commands. This heap-based buffer overflow (CWE-122) occurs in memory regions allocated on the heap-typically used for dynamic data structures-allowing attackers to write beyond allocated buffer boundaries. The flaw is triggered during job attribute parsing, which occurs before authentication and access control checks in the CUPS processing pipeline.

RemediationAI

No vendor-released patch identified at time of analysis. Organizations should monitor the OpenPrinting CUPS repository (https://github.com/OpenPrinting/cups) and the security advisory GHSA-6qxf-7jx6-86fh for patch releases. Until a patch is available, mitigate risk by restricting network access to the CUPS daemon (typically listening on localhost:631) using firewall rules to limit exposure to trusted internal networks only. Disable remote printing if not required. Consider running CUPS in a sandboxed environment or behind a network access control proxy. Subscribe to the OpenPrinting mailing list for notifications when patches are released.

More in Cups

View all
CVE-2015-1158 CRITICAL POC
10.0 Jun 26

The add_job function in scheduler/ipp.c in cupsd in CUPS before 2.0.3 performs incorrect free operations for multiple-va
CVE-2015-1159 MEDIUM POC
4.3 Jun 26

Cross-site scripting (XSS) vulnerability in the cgi_puts function in cgi-bin/template.c in the template engine in CUPS b
CVE-2012-5519 HIGH POC
7.2 Nov 20

CUPS 1.4.4, when running in certain Linux distributions such as Debian GNU/Linux, stores the web interface administrator
CVE-2023-34241 HIGH POC
7.1 Jun 22

OpenPrinting CUPS is a standards-based, open source printing system for Linux and other Unix-like operating systems. Rat
CVE-2023-4504 HIGH POC
7.0 Sep 21

Due to failure in validating the length provided by an attacker-crafted PPD PostScript document, CUPS and libppd are sus
CVE-2025-58364 MEDIUM POC
6.5 Sep 11

OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Rated medium severi
CVE-2025-61915 MEDIUM POC
6.0 Nov 29

OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Rated medium severi
CVE-2023-32324 MEDIUM POC
5.5 Jun 01

OpenPrinting CUPS is an open source printing system. Rated medium severity (CVSS 5.5), this vulnerability is no authenti
CVE-2025-58436 MEDIUM POC
5.1 Nov 29

OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Rated medium severi
CVE-2018-6553 HIGH
8.8 Aug 10

The CUPS AppArmor profile incorrectly confined the dnssd backend due to use of hard links. Rated high severity (CVSS 8.8
CVE-2014-9679 MEDIUM
6.8 Feb 19

Integer underflow in the cupsRasterReadPixels function in filter/raster.c in CUPS before 2.0.2 allows remote attackers t
CVE-2022-26691 MEDIUM
6.7 May 26

A logic issue was addressed with improved state management. Rated medium severity (CVSS 6.7), this vulnerability is low

Same weakness CWE-122 – Heap-based Buffer Overflow

View all
CVE-2023-4911 HIGH POC
7.8
CVE-2023-27997 CRITICAL
9.8
CVE-2025-25249 CRITICAL POC
9.8
CVE-2026-85880 HIGH POC
7.8
CVE-2025-24985 HIGH POC
7.8
CVE-2026-53362 HIGH POC
7.8
CVE-2025-21418 HIGH
7.8
CVE-2023-23376 HIGH
7.8

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise Micro 5.2 Fixed
SUSE Linux Enterprise Micro 5.3 Fixed
SUSE Linux Enterprise Micro 5.4 Fixed

Share

CVE-2026-34979 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy