OpenPrinting CUPS EUVD-2026-95476

Exploitation requires that CUPS be using temporary printers (auto-created when clients access a shared or network-discovered destination) AND that a job be submitted with the job-held-on-create attribute referencing such a temporary printer. The crash occurs only when temporary-printer cleanup deletes that destination while the held job still references it, so cupsdFindDest() returns NULL during the holding_new_jobs check in cupsdCheckJobs(). Limiting factors: high attack complexity (AC:H) due to the required ordering/timing between held-job submission and automatic printer deletion, dependence on the temporary-printer feature being exercised, and affected versions being CUPS before 2.4.20; impact is confined to denial of service of cupsd and its queues.

This is a moderate-severity availability-only defect (CVSS 5.1, A:H with C:N/I:N) rather than a top-tier priority. The CVSS vector (AV:L/AC:H/PR:N/UI:N) describes a local attack with high complexity, which is consistent with the described race-like condition: a held job must reference a temporary printer that is then auto-deleted before the job is canceled. There is a notable conflict to flag: the CVSS vector specifies AV:L (local) and PR:N (no privileges), yet the description says 'an unprivileged submission can trigger this' and CUPS job submission commonly occurs over IPP, which could imply a network path - verify the true attack surface with the vendor/GHSA advisory before treating this as purely local. No EPSS score, KEV listing, or POC was supplied; with no public exploit identified at time of analysis and high attack complexity, real-world exploitation risk is currently low-to-moderate and best characterized as targeted/opportunistic DoS rather than widespread. The impact is limited to crashing cupsd and interrupting its managed queues - disruptive but not a confidentiality or integrity compromise.

A local, low-privilege user submits a print job with the job-held-on-create option targeting a temporary printer (the kind auto-created when accessing a shared/network destination). When temporary-printer cleanup deletes that destination while the held job still references it, cupsdCheckJobs() dereferences the NULL return of cupsdFindDest(), crashing cupsd and halting all its queues. No public exploit code is identified at time of analysis, and the high complexity (AC:H) reflects the specific timing/configuration required.