Cups CVE-2026-34979

The risk profile is moderate despite the 5.3 CVSS score. The attack vector is network-based and requires no authentication or user interaction (CVSS: AV:N/AC:L/PR:N/UI:N), making exploitation straightforward from a network perspective. However, the impact is limited to availability (A:L); confidentiality and integrity are not affected, meaning data theft or privilege escalation is not possible through this path. The absence of a vendor patch as of publication increases operational risk. No active exploitation (KEV status not confirmed) or public proof-of-concept has been identified, reducing immediate threat level. Organizations running internet-facing CUPS daemons (uncommon but present in some print server deployments) face higher risk than those with network-restricted access. This is a real priority for patch-management timelines but not a critical emergency compared to remote code execution vulnerabilities.

An attacker on an accessible network sends a specially crafted print job with oversized or malformed job attributes to a CUPS scheduler. The scheduler attempts to build filter option strings from these attributes without validating buffer sizes, causing a heap overflow that corrupts adjacent memory structures. This leads to a crash or denial of service on the CUPS daemon, preventing legitimate print operations until the service is restarted. The attack requires only network reachability to the CUPS port and no credentials, though such exposure is typically limited to internal networks.