Cups CVE-2026-34980

Although CVSS scoring is not available, the vulnerability presents critical real-world risk. The attack vector is network-based and requires no authentication (consistent with unauthenticated Print-Job submission to shared queues), and complexity appears low given the straightforward newline injection technique. The ability to execute arbitrary binaries as lp user constitutes high technical impact (code execution). Without CVSS and EPSS data, and absent confirmation of CISA KEV status or public POC, the risk must be assessed through the attack surface: any network-exposed cupsd with shared queues is vulnerable, and CUPS is ubiquitous in enterprise Linux environments. The absence of publicly available patches at publication further elevates urgency. This is a genuine priority vulnerability, not a false positive-authentication bypass combined with RCE on widely deployed infrastructure justifies immediate attention.

An attacker on a network with access to a CUPS instance discovers a shared PostScript print queue. The attacker sends an unauthenticated Print-Job request with a crafted page-border parameter containing a newline and PPD scheduler control directive (e.g., instructing the server to execute /usr/bin/vim). This exploit leverages the lack of authentication checks on shared queues and the newline injection flaw to inject a trusted scheduler record. A follow-up raw print job then triggers execution of the attacker's chosen binary as the lp user, yielding remote code execution. No public POC confirmed; exploitation depends on network exposure and queue configuration.