Cups EUVD-2026-19805

The CVSS score of 4.0 with a low attack complexity and no privilege requirement reflects a bounded denial-of-service impact limited to availability. The CVSS vector (AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) confirms this is a local attack requiring no authentication but also no network attack surface, and the impact is constrained to a single process restart rather than data compromise. However, the real-world risk is elevated by two factors: (1) the vulnerability requires only unprivileged local access-a low bar for compromise in multi-user systems or container environments-and (2) systemd's Restart=on-failure configuration, common in modern deployments, enables trivial sustained denial of service by repeatedly triggering the crash. The lack of any confidentiality or integrity impact keeps this in the low-severity category, but the ease of triggering and predictability of the crash make it an operational nuisance rather than a critical security hole. This is a justified low CVSS with moderate practical impact in specific deployment scenarios.

An unprivileged local user on a system running CUPS 2.4.16 or earlier crafts a malicious IPP request containing a negative value for the job-password-supported attribute and submits it to the local CUPS daemon. The _ppdCreateFromIPP() function fails to validate the negative bound, casts it to size_t, and passes the wrapped value to memset() on a 33-byte stack buffer, immediately crashing the root-privileged cupsd process with SIGSEGV. If systemd is configured to restart the service on failure, the attacker repeats the request to maintain continuous denial of service without requiring elevated privileges or exploiting any authentication mechanism. No exploit code is required beyond standard IPP client tools.