Red Hat CVE-2026-39314

The vulnerability resides in the PPD (PostScript Printer Description) cache creation function within cups/ppd-cache.c. The integer underflow occurs because validation logic checks only the upper bound of the job-password-supported attribute count, permitting negative values to pass validation. When a negative integer is cast to size_t (unsigned), it wraps to approximately 2^64, which is then used as the length parameter for memset() operating on a 33-byte stack-allocated buffer. This triggers an out-of-bounds write that causes an immediate segmentation fault (SIGSEGV) in the root-privileged cupsd daemon. The root cause is classified as CWE-191 (Integer Underflow or Wrap), a classic flaw in bounds checking logic that fails to validate the lower bound of numeric inputs before type conversion.