Cups CVE-2026-39316

The CVSS v3.1 score of 4.0 with vector CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L indicates a local vector (AV:L) requiring no privileges (PR:N) but no user interaction, with impact limited to availability. However, the description explicitly notes that heap grooming can elevate this to remote code execution, making the real-world risk significantly higher than the base CVSS score suggests. Since this is a local vulnerability requiring direct system access, the practical threat is moderate for multi-user systems and low for single-user desktops. The confirmed presence of use-after-free memory corruption (a class often leveraged for code execution) elevates concern beyond the DOS impact reflected in CVSS. No EPSS data, KEV status, or public exploit code was provided, meaning exploitation likelihood cannot be quantified from standard metrics, but the low CVSS AC and PR requirements indicate straightforward triggering.

An unauthenticated local attacker with access to the system creates temporary printers that trigger the automatic cleanup routine. When cupsdDeleteTemporaryPrinters() executes and deletes printers without properly handling subscriptions, the scheduler crashes due to dereferencing the dangling pointer in the subscription structure. With careful heap grooming (e.g., allocating controlled memory chunks to occupy the freed space), an attacker can overwrite the dangling pointer or adjacent heap structures to achieve code execution within the privileged cupsd process context.