Red Hat EUVD-2026-19806

The vulnerability is a use-after-free (CWE-416) in the CUPS scheduler daemon (cupsd), specifically in the cupsdDeleteTemporaryPrinters() function within scheduler/printers.c. When temporary printers are automatically deleted, the function calls cupsdDeletePrinter() without first expiring subscription objects (cupsd_subscription_t) that reference the printer. This leaves the dest field of subscription structures pointing to freed heap memory. The dangling pointer is later dereferenced at multiple code sites during normal scheduler operation, triggering a crash. With deliberate heap grooming, an attacker can control the freed memory region to achieve code execution. The vulnerability affects the core printing system daemon that runs with elevated privileges on Unix-like systems including Linux.