OpenPrinting CUPS EUVD-2026-92637

Exploitation requires three concrete preconditions: (1) CUPS must be configured for email notifications so that the mailto notifier (notifier/mailto.c) is invoked; (2) the attacker must be able to register a printer subscription supplying a notify-recipient-uri, which per PR:L needs a low-privilege authenticated/authorized position on the scheduler; and (3) the host's configured sendmail/MTA must interpret a recipient string beginning with '-' as a command-line option rather than an address. Limiting factors: email notification is not a default CUPS configuration, default CUPS typically listens only on localhost (consistent with the AV:L rating, limiting true remote reach unless the service is network-exposed), and impact is gated by the specific MTA behavior. The absence of any of these conditions prevents exploitation.

This is a genuinely low-priority issue despite the command-execution language in the description. The authoritative Red Hat CVSS vector (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N) scores it only 2.5, reflecting that exploitation is conditional and low-impact as rated. There is a notable conflict between the CVSS attack vector and the prose: the vector is AV:L (local), yet the description states 'a remote attacker who can reach the CUPS service' - this discrepancy should be verified with the vendor, and likely reflects that default CUPS installations bind only to localhost, so 'remote' means reachable-on-the-network-only-when-exposed rather than default-remote. No EPSS score, no CISA KEV listing, and no public POC are present in the supplied data, so exploitation status is 'no public exploit identified at time of analysis.' No SSVC decision record was provided. Several hard preconditions (email notification must be configured, the attacker must be able to register a subscription, and the installed MTA must interpret a leading '-' as options) combine with AC:H to make real-world exploitation unlikely and non-automatable. A patch exists (OpenPrinting/cups commits 1244ed9 and 611d1bd add input validation via copy_validate_address). Bottom line: low real risk; patch via normal maintenance cadence rather than emergency response, but note the description's 'command execution' potential means impact could exceed the 2.5 score if a permissive MTA is deployed.

On a CUPS host configured with email notifications, an attacker who can reach the scheduler creates a printer subscription whose notify-recipient-uri is a crafted mailto value whose address begins with '-', causing the mailto notifier to pass that string to the sendmail binary as a command-line option. If the installed MTA interprets the injected option (e.g., to control output files or configuration), attacker-influenced commands may run as the CUPS service user. No public exploit code is identified in the provided data, and success is highly dependent on the specific sendmail implementation.