CUPS CVE-2026-87875

CUPS must be actively performing SNMP-based printer discovery - the snmp backend must be present and active in the CUPS configuration (not disabled). The attacker must be on the same adjacent network segment (LAN/subnet/VLAN) as the CUPS host, satisfying the AV:A constraint; internet-based exploitation is not possible with this vector. No authentication to CUPS or the target system is required. The vulnerable path is only triggered when the CUPS snmp backend receives and attempts to parse a supply-description response, so passive CUPS installations that are not polling for network printers would not be reached. Exploitation is limited to confidentiality (heap memory disclosure); no crash or code execution impact is established from the available data.

The CVSS 3.1 score of 4.3 (AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) accurately characterizes this as a moderate, confidentiality-only issue confined to adjacent network segments. The AV:A vector is a meaningful limiter - the attacker must be positioned to inject or spoof SNMP responses on the same broadcast domain or subnet as the CUPS host, ruling out remote internet-based exploitation. Impact is limited to C:L (partial heap disclosure); no integrity or availability impact is established. No EPSS score, KEV listing, or public exploit code was provided in the intelligence data. The realistic threat model centers on an attacker already present on a corporate LAN or a rogue device on a printer VLAN, making this a post-initial-access reconnaissance primitive rather than a primary attack vector. The confidentiality impact is bounded by what resides in the CUPS daemon's heap near the over-read, which may include printer configuration, job metadata, or other heap-resident strings - not necessarily sensitive credentials. This is a real but not critical priority.

An attacker positioned on the same network segment as a CUPS-enabled Linux host waits for or triggers SNMP printer discovery, then responds with a crafted SNMP supply-description payload containing oversized UTF-32 encoded data. The cupsUTF32ToUTF8() function reads past the end of the heap-allocated source buffer, disclosing adjacent heap contents from the CUPS daemon process to the attacker. No public exploit code has been identified at this time.