Skip to main content

OpenPrinting CUPS CVE-2026-41079

| EUVDEUVD-2026-25574 MEDIUM
Out-of-bounds Read (CWE-125)
2026-04-24 security-advisories@github.com
Buffer Overflow Information Disclosure Red Hat Suse Cups Openprinting
4.3
CVSS 3.1 · GitHub Advisory
Share

Severity by source

GitHub Advisory PRIMARY
4.3 MEDIUM
AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
SUSE
MEDIUM
qualitative
Red Hat
4.3 LOW
qualitative

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

Attack Vector
Adjacent
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None

Lifecycle Timeline

6
Patch released
Apr 27, 2026 - 13:40 nvd
Patch available
Patch available
Apr 24, 2026 - 18:01 EUVD
Analysis Generated
Apr 24, 2026 - 17:32 vuln.today
EUVD ID Assigned
Apr 24, 2026 - 17:22 euvd
EUVD-2026-25574
Analysis Generated
Apr 24, 2026 - 17:22 vuln.today
CVE Published
Apr 24, 2026 - 17:16 nvd
MEDIUM 4.3

DescriptionGitHub Advisory

OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.17, a network-adjacent attacker can send a crafted SNMP response to the CUPS SNMP backend that causes an out-of-bounds read of up to 176 bytes past a stack buffer. The leaked memory is converted from UTF-16 to UTF-8 and stored as printer supply description strings, which are subsequently visible to authenticated users via IPP Get-Printer-Attributes responses and the CUPS web interface. This vulnerability is fixed in 2.4.17.

AnalysisAI

OpenPrinting CUPS before version 2.4.17 allows network-adjacent attackers to read up to 176 bytes of stack memory via a crafted SNMP response sent to the CUPS SNMP backend, with leaked data visible to authenticated users through IPP Get-Printer-Attributes responses and the web interface. The vulnerability requires adjacency on the network but no authentication, making it a low-severity information disclosure risk in environments where SNMP-enabled printers are accessible from untrusted networks.

Technical ContextAI

CUPS includes an SNMP backend that queries network printers for supply and status information using SNMP protocol. The vulnerability is a classic out-of-bounds read (CWE-125) in the SNMP response parser, where insufficient bounds checking during UTF-16 to UTF-8 conversion of SNMP response fields allows reading beyond allocated stack buffer boundaries. The leaked bytes are then stored as printer supply description strings and exposed via IPP (Internet Printing Protocol) Get-Printer-Attributes responses, which authenticated users can query. This affects CUPS' network printer discovery and monitoring functionality, which relies on SNMP to gather supply levels and device attributes from network-attached devices.

RemediationAI

Upgrade CUPS to version 2.4.17 or later; this is the vendor-released patch and is the definitive fix. For systems unable to upgrade immediately, disable or restrict SNMP backend functionality by editing the CUPS configuration to remove SNMP from the list of supported device discovery backends, or use firewall rules to block inbound SNMP traffic (UDP port 161) at the network perimeter. Restricting SNMP access to trusted administrative networks only is a practical interim measure that preserves printer discovery functionality while eliminating the attack vector. Note that disabling SNMP will prevent automatic supply-level monitoring and network printer discovery, requiring manual configuration of printers instead. The GitHub security advisory at https://github.com/OpenPrinting/cups/security/advisories/GHSA-6wpw-g8g6-wvrv contains patch commit hashes (b7c2525a and d7fe0f52) for verification and detailed remediation guidance.

More in Cups

View all
CVE-2015-1158 CRITICAL POC
10.0 Jun 26

The add_job function in scheduler/ipp.c in cupsd in CUPS before 2.0.3 performs incorrect free operations for multiple-va
CVE-2015-1159 MEDIUM POC
4.3 Jun 26

Cross-site scripting (XSS) vulnerability in the cgi_puts function in cgi-bin/template.c in the template engine in CUPS b
CVE-2012-5519 HIGH POC
7.2 Nov 20

CUPS 1.4.4, when running in certain Linux distributions such as Debian GNU/Linux, stores the web interface administrator
CVE-2023-34241 HIGH POC
7.1 Jun 22

OpenPrinting CUPS is a standards-based, open source printing system for Linux and other Unix-like operating systems. Rat
CVE-2023-4504 HIGH POC
7.0 Sep 21

Due to failure in validating the length provided by an attacker-crafted PPD PostScript document, CUPS and libppd are sus
CVE-2025-58364 MEDIUM POC
6.5 Sep 11

OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Rated medium severi
CVE-2025-61915 MEDIUM POC
6.0 Nov 29

OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Rated medium severi
CVE-2023-32324 MEDIUM POC
5.5 Jun 01

OpenPrinting CUPS is an open source printing system. Rated medium severity (CVSS 5.5), this vulnerability is no authenti
CVE-2025-58436 MEDIUM POC
5.1 Nov 29

OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Rated medium severi
CVE-2018-6553 HIGH
8.8 Aug 10

The CUPS AppArmor profile incorrectly confined the dnssd backend due to use of hard links. Rated high severity (CVSS 8.8
CVE-2014-9679 MEDIUM
6.8 Feb 19

Integer underflow in the cupsRasterReadPixels function in filter/raster.c in CUPS before 2.0.2 allows remote attackers t
CVE-2022-26691 MEDIUM
6.7 May 26

A logic issue was addressed with improved state management. Rated medium severity (CVSS 6.7), this vulnerability is low

Same weakness CWE-125 – Out-of-bounds Read

View all
CVE-2014-0160 HIGH POC
7.5
CVE-2016-5198 HIGH POC
8.8
CVE-2025-5777 CRITICAL POC
9.3
CVE-2016-1646 HIGH POC
8.8
CVE-2017-5030 HIGH POC
8.8
CVE-2016-4523 HIGH
7.5
CVE-2024-48456 HIGH POC
7.5
CVE-2024-48457 HIGH POC
7.5

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise Micro 5.2 Fixed
SUSE Linux Enterprise Micro 5.3 Fixed
SUSE Linux Enterprise Micro 5.4 Fixed

Share

CVE-2026-41079 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy