Skip to main content

Cups CVE-2026-39316

| EUVDEUVD-2026-19806 MEDIUM
Use After Free (CWE-416)
2026-04-07 security-advisories@github.com
RCE Denial Of Service Use After Free Memory Corruption Red Hat Suse Cups Openprinting
4.0
CVSS 3.1 · GitHub Advisory
Share

Severity by source

GitHub Advisory PRIMARY
4.0 MEDIUM
AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
SUSE
6.2 MEDIUM
AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Red Hat
4.0 MEDIUM
qualitative

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
Low

Lifecycle Timeline

3
EUVD ID Assigned
Apr 07, 2026 - 17:22 euvd
EUVD-2026-19806
Analysis Generated
Apr 07, 2026 - 17:22 vuln.today
CVE Published
Apr 07, 2026 - 17:16 nvd
MEDIUM 4.0

DescriptionGitHub Advisory

OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.16 and prior, a use-after-free vulnerability exists in the CUPS scheduler (cupsd) when temporary printers are automatically deleted. cupsdDeleteTemporaryPrinters() in scheduler/printers.c calls cupsdDeletePrinter() without first expiring subscriptions that reference the printer, leaving cupsd_subscription_t.dest as a dangling pointer to freed heap memory. The dangling pointer is subsequently dereferenced at multiple code sites, causing a crash (denial of service) of the cupsd daemon. With heap grooming, this can be leveraged for code execution.

AnalysisAI

Local denial of service and potential remote code execution in OpenPrinting CUPS 2.4.16 and prior occurs when the scheduler (cupsd) deletes temporary printers without expiring associated subscriptions, leaving dangling pointers in memory that are subsequently dereferenced. An unauthenticated local attacker can crash the cupsd daemon or, with heap grooming techniques, achieve arbitrary code execution on systems running affected CUPS versions.

Technical ContextAI

The vulnerability is a use-after-free (CWE-416) in the CUPS scheduler daemon (cupsd), specifically in the cupsdDeleteTemporaryPrinters() function within scheduler/printers.c. When temporary printers are automatically deleted, the function calls cupsdDeletePrinter() without first expiring subscription objects (cupsd_subscription_t) that reference the printer. This leaves the dest field of subscription structures pointing to freed heap memory. The dangling pointer is later dereferenced at multiple code sites during normal scheduler operation, triggering a crash. With deliberate heap grooming, an attacker can control the freed memory region to achieve code execution. The vulnerability affects the core printing system daemon that runs with elevated privileges on Unix-like systems including Linux.

RemediationAI

Upgrade to a patched version of OpenPrinting CUPS released after version 2.4.16 (specific fix version should be confirmed from the vendor advisory at https://github.com/OpenPrinting/cups/security/advisories/GHSA-pjv5-prqp-46rg). Linux distributions will release patched packages through their standard package managers; users should apply updates via apt, yum, dnf, or equivalent package management tools once available. In the interim, on systems where temporary printers are used, administrators can mitigate exposure by disabling automatic deletion of temporary printers or restricting local access to printer management interfaces if operationally feasible, though these are workarounds pending patch application.

More in Cups

View all
CVE-2015-1158 CRITICAL POC
10.0 Jun 26

The add_job function in scheduler/ipp.c in cupsd in CUPS before 2.0.3 performs incorrect free operations for multiple-va
CVE-2015-1159 MEDIUM POC
4.3 Jun 26

Cross-site scripting (XSS) vulnerability in the cgi_puts function in cgi-bin/template.c in the template engine in CUPS b
CVE-2012-5519 HIGH POC
7.2 Nov 20

CUPS 1.4.4, when running in certain Linux distributions such as Debian GNU/Linux, stores the web interface administrator
CVE-2023-34241 HIGH POC
7.1 Jun 22

OpenPrinting CUPS is a standards-based, open source printing system for Linux and other Unix-like operating systems. Rat
CVE-2023-4504 HIGH POC
7.0 Sep 21

Due to failure in validating the length provided by an attacker-crafted PPD PostScript document, CUPS and libppd are sus
CVE-2025-58364 MEDIUM POC
6.5 Sep 11

OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Rated medium severi
CVE-2025-61915 MEDIUM POC
6.0 Nov 29

OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Rated medium severi
CVE-2023-32324 MEDIUM POC
5.5 Jun 01

OpenPrinting CUPS is an open source printing system. Rated medium severity (CVSS 5.5), this vulnerability is no authenti
CVE-2025-58436 MEDIUM POC
5.1 Nov 29

OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Rated medium severi
CVE-2018-6553 HIGH
8.8 Aug 10

The CUPS AppArmor profile incorrectly confined the dnssd backend due to use of hard links. Rated high severity (CVSS 8.8
CVE-2014-9679 MEDIUM
6.8 Feb 19

Integer underflow in the cupsRasterReadPixels function in filter/raster.c in CUPS before 2.0.2 allows remote attackers t
CVE-2022-26691 MEDIUM
6.7 May 26

A logic issue was addressed with improved state management. Rated medium severity (CVSS 6.7), this vulnerability is low

Same weakness CWE-416 – Use After Free

View all
CVE-2019-0708 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2014-0322 HIGH POC
8.8
CVE-2012-4792 HIGH POC
8.8
CVE-2009-4324 HIGH POC
7.8
CVE-2015-0313 CRITICAL POC
9.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2013-2551 HIGH POC
8.8

Same technique RCE

View all
CVE-2021-44228 CRITICAL POC
10.0
CVE-2017-7269 CRITICAL POC
9.8
CVE-2022-47966 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2023-3519 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2016-4117 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise Micro 5.2 Fixed
SUSE Linux Enterprise Micro 5.3 Fixed
SUSE Linux Enterprise Micro 5.4 Fixed

Share

CVE-2026-39316 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy