Openprinting
Monthly
CUPS is a standards-based, open-source printing system, and `cups-browsed` contains network printing functionality including, but not limited to, auto-discovering print services and shared printers. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
CUPS is a standards-based, open-source printing system, and `libcupsfilters` contains the code of the filters of the former `cups-filters` package as library functions to be used for the data format. Rated high severity (CVSS 8.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Denial of service in OpenPrinting CUPS before 2.4.20 lets a crafted Print-Job IPP request terminate the cupsd scheduler, taking every queue it serves offline with it. Repeated IPP group tags cause the parser to create unnamed separator attributes (IPP_TAG_ZERO) that add_job() re-tags as IPP_TAG_JOB; when the job starts, get_options()/ipp_length() calls strlen() on the NULL attribute name and crashes the daemon (CWE-476). The vendor scores this 3.3 on a local vector, while our assessment rates it CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, since an attacker who can reach the scheduler and submit to an enabled, accepting queue supporting the submitted document format can cause it; PR:L in the assessed vector indicates authenticated access is normally required, with anonymous submission possible only where listener and access-control configuration explicitly allow it. No public exploit code was identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV); this is a low-severity availability issue rather than an urgent priority for most environments.
Denial of service in OpenPrinting CUPS before 2.4.20 lets a local, low-privileged user crash the cupsd scheduler by submitting a print job with the job-held-on-create attribute that references a temporary printer, which can then be auto-deleted while the held job still references it, triggering a NULL pointer dereference in cupsdCheckJobs(). The crash occurs when cupsdFindDest() returns NULL during the holding_new_jobs check, terminating cupsd and interrupting every queue it manages. Exploitation requires the temporary-printer feature (auto-created for shared or network-discovered destinations) to be in use and depends on timing between held-job submission and automatic printer cleanup, giving high attack complexity (AC:H) and availability-only impact (CVSS 5.1, C:N/I:N/A:H); no public exploit code has been identified at time of analysis.
Denial of service in OpenPrinting CUPS before 2.4.20 lets an actor holding @SYSTEM-level class-management privileges crash the cupsd scheduler by triggering a double-free in printer-class handling. The actor submits a CUPS-Add-Modify-Class request that replaces an existing class's member list and then fails subsequent validation, leaving pclass->printers as a dangling pointer, then issues a CUPS-Delete-Class request so cupsdDeletePrinter() frees the same allocation a second time. Impact is confined to availability (scheduler crash) with no confidentiality or integrity effect, and no public exploit identified at time of analysis - the @SYSTEM privilege prerequisite (PR:H) is the dominant limiting factor, keeping overall risk low even though the assessed vector is network-reachable (AV:N/AC:H) when the CUPS listener is exposed.
Resource exhaustion in OpenPrinting CUPS (all versions through 2.4.20) lets an authorized print submitter stall the scheduler's job-timeout handling, so incomplete jobs accumulate until MaxJobs is exhausted and further legitimate print submissions are rejected. The defect in cupsdCheckJobs() suppresses submission-timeout processing for every pending job whenever any client connection holds an in-flight Send-Document operation, without matching that connection to the job being examined (CWE-770); per the independent assessment the attack surface is AV:N/AC:L with PR:L, meaning the attacker must already be a principal permitted to reach the IPP/HTTP service and allowed to submit Create-Job requests, not an anonymous outsider. Impact is transient and self-correcting once the held connection closes, with no persistence, data exposure, or effect beyond blocking new jobs; no public exploit code and no CISA KEV activity were identified at time of analysis, and the independent assessment rates this as a genuinely low-priority issue.
Ubuntu Linux carries CVE-2026-55453, a security issue that has so far been reported only by the vendor (Ubuntu) with no published description, no CVSS score or vector, no CWE classification, and no CPE or version data. Because the flaw is entirely undisclosed, it is not possible to state which package, subsystem, or Ubuntu release is affected, what an attacker would need to reach it, or what the resulting impact would be. There is no public exploit identified at time of analysis, no KEV listing, no EPSS score, and no confirmed patch availability, so the item should be treated as an unassessed placeholder pending the corresponding Ubuntu Security Notice (USN) and NVD entry.
CVE-2026-55480 is currently recorded only against Ubuntu Linux, with the sole intelligence signal being that the entry was reported by vendor:ubuntu, meaning Canonical's security team is the originating source for the record. The supplied data contains no description, no CVSS score or vector, no CWE classification, no CPE strings, and no version ranges, so the specific component, attack vector, authentication requirement, and impact cannot be characterized at this time. No public exploit code has been identified at time of analysis, and no CISA KEV listing is present, but this reflects the absence of data rather than a confirmed negative - defenders should treat the entry as unassessed and pull the authoritative record from the Ubuntu CVE tracker and NVD before drawing any risk conclusion.
CVE-2026-61702 is recorded in this dataset solely as a vendor-sourced report from Ubuntu, with no description, no CVSS score or vector, no CWE mapping, and no CPE data, so the specific Ubuntu package, upstream component, and version range involved cannot be identified. Because the description is '[Unknown description]', no attacker capability, impact, or exploitation precondition can be stated, and the EPSS, KEV, and proof-of-concept signals are all absent - there is no evidence of active exploitation and no public exploit code identified at time of analysis, though that absence reflects missing data rather than a positive finding of safety. Risk cannot be meaningfully assessed from the provided data because nearly every decision signal is absent; prioritization should be deferred until the Ubuntu Security Notice and canonical CVE description are retrieved.
OpenPrinting CUPS before version 2.4.17 allows network-adjacent attackers to read up to 176 bytes of stack memory via a crafted SNMP response sent to the CUPS SNMP backend, with leaked data visible to authenticated users through IPP Get-Printer-Attributes responses and the web interface. The vulnerability requires adjacency on the network but no authentication, making it a low-severity information disclosure risk in environments where SNMP-enabled printers are accessible from untrusted networks.
Local denial of service and potential remote code execution in OpenPrinting CUPS 2.4.16 and prior occurs when the scheduler (cupsd) deletes temporary printers without expiring associated subscriptions, leaving dangling pointers in memory that are subsequently dereferenced. An unauthenticated local attacker can crash the cupsd daemon or, with heap grooming techniques, achieve arbitrary code execution on systems running affected CUPS versions.
Denial of service in OpenPrinting CUPS 2.4.16 and prior allows unprivileged local users to crash the cupsd root process via integer underflow in _ppdCreateFromIPP() by supplying a negative job-password-supported IPP attribute, which wraps to a large size_t value and triggers a stack buffer overflow in memset(). When combined with systemd's automatic restart mechanism, an attacker can sustain repeated crashes without requiring elevated privileges or user interaction.
Unauthenticated remote code execution in OpenPrinting CUPS 2.4.16 and earlier allows attackers to send print jobs to shared PostScript queues without authentication, exploit a newline injection vulnerability in page-border parameter handling, and execute arbitrary binaries as the lp user by chaining a follow-up raw print job. CISA KEV status and active exploitation confirmation not provided; no publicly available patches identified at publication.
Heap-based buffer overflow in OpenPrinting CUPS scheduler versions 2.4.16 and prior allows unauthenticated remote attackers to trigger a denial of service condition by crafting malicious job attributes that overflow buffers during filter option string construction. With a CVSS score of 5.3 and network accessibility, this vulnerability impacts availability on exposed CUPS instances; no public exploit code or vendor patch has been released as of publication.
Path traversal in OpenPrinting CUPS RSS notifier (versions 2.4.16 and prior) allows unauthenticated remote IPP clients to write arbitrary files outside the intended CacheDir/rss directory via a crafted notify-recipient-uri parameter. By exploiting default group-writable permissions on CacheDir, attackers can overwrite critical state files such as job.cache, causing the CUPS scheduler to fail parsing job queues and resulting in loss of previously queued print jobs. No public exploit code or vendor patch is currently available, though the vulnerability is demonstrated with proof-of-concept exploitation.
Local privilege escalation in OpenPrinting CUPS 2.4.16 and prior allows unprivileged users to bypass authentication and create arbitrary file overwrites as root by coercing cupsd into issuing reusable Authorization tokens and leveraging printer-sharing policies to persist file:// URIs that bypass FileDevice restrictions. A proof-of-concept demonstrates root command execution via sudoers file modification, and the vulnerability is confirmed by the presence of public exploit code.
CUPS daemon (cupsd) versions 2.4.16 and earlier authenticate users via case-insensitive username comparison, allowing an authenticated high-privileged user to bypass authorization controls by submitting requests under a username that differs only in case from an authorized user, gaining access to restricted printing operations. No public exploit code has been identified, and patches were not available at the time of initial disclosure, though a upstream commit indicates a fix may have been prepared.
OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Rated medium severity (CVSS 6.0), this vulnerability is low attack complexity. Public exploit code available.
OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Rated medium severity (CVSS 5.1), this vulnerability is no authentication required. Public exploit code available.
cups-filters contains backends, filters, and other software required to get the cups printing service working on operating systems other than macos. Rated low severity (CVSS 3.3), this vulnerability is low attack complexity. Public exploit code available.
cups-filters contains backends, filters, and other software required to get the cups printing service working on operating systems other than macos. Rated medium severity (CVSS 4.0), this vulnerability is no authentication required, low attack complexity. Public exploit code available.
CUPS is a standards-based, open-source printing system, and `libcupsfilters` contains the code of the filters of the former `cups-filters` package as library functions to be used for the data format. Rated low severity (CVSS 3.7). Public exploit code available.
OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Rated medium severity (CVSS 6.5), this vulnerability is no authentication required, low attack complexity. Public exploit code available.
OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Rated high severity (CVSS 8.0), this vulnerability is no authentication required, low attack complexity. Public exploit code available.
A stack based buffer overflow vulnerability is present in OpenPrinting ippusbxd 1.34. Rated medium severity (CVSS 6.4), this vulnerability is no authentication required. Public exploit code available and no vendor patch available.
Due to failure in validating the length provided by an attacker-crafted PPD PostScript document, CUPS and libppd are susceptible to a heap-based buffer overflow and possibly code execution. Rated high severity (CVSS 7.0), this vulnerability is no authentication required. Public exploit code available and no vendor patch available.
OpenPrinting CUPS is a standards-based, open source printing system for Linux and other Unix-like operating systems. Rated high severity (CVSS 7.1), this vulnerability is low attack complexity. Public exploit code available.
cpdb-libs provides frontend and backend libraries for the Common Printing Dialog Backends (CPDB) project. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
OpenPrinting CUPS is an open source printing system. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A logic issue was addressed with improved state management. Rated medium severity (CVSS 6.7), this vulnerability is low attack complexity.
Alpine Linux has issued a fix for an unspecified vulnerability in the CUPS printing package, addressed in cups version 2.4.20-r0. The advisory provides no description of the flaw, its impact, or attack vector; consequently, the risk cannot be meaningfully quantified, and authentication requirements are not confirmed from available data. No public exploit code has been identified at time of analysis, and there is no indication of active exploitation (CISA KEV).
CUPS is a standards-based, open-source printing system, and `cups-browsed` contains network printing functionality including, but not limited to, auto-discovering print services and shared printers. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
CUPS is a standards-based, open-source printing system, and `libcupsfilters` contains the code of the filters of the former `cups-filters` package as library functions to be used for the data format. Rated high severity (CVSS 8.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Denial of service in OpenPrinting CUPS before 2.4.20 lets a crafted Print-Job IPP request terminate the cupsd scheduler, taking every queue it serves offline with it. Repeated IPP group tags cause the parser to create unnamed separator attributes (IPP_TAG_ZERO) that add_job() re-tags as IPP_TAG_JOB; when the job starts, get_options()/ipp_length() calls strlen() on the NULL attribute name and crashes the daemon (CWE-476). The vendor scores this 3.3 on a local vector, while our assessment rates it CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, since an attacker who can reach the scheduler and submit to an enabled, accepting queue supporting the submitted document format can cause it; PR:L in the assessed vector indicates authenticated access is normally required, with anonymous submission possible only where listener and access-control configuration explicitly allow it. No public exploit code was identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV); this is a low-severity availability issue rather than an urgent priority for most environments.
Denial of service in OpenPrinting CUPS before 2.4.20 lets a local, low-privileged user crash the cupsd scheduler by submitting a print job with the job-held-on-create attribute that references a temporary printer, which can then be auto-deleted while the held job still references it, triggering a NULL pointer dereference in cupsdCheckJobs(). The crash occurs when cupsdFindDest() returns NULL during the holding_new_jobs check, terminating cupsd and interrupting every queue it manages. Exploitation requires the temporary-printer feature (auto-created for shared or network-discovered destinations) to be in use and depends on timing between held-job submission and automatic printer cleanup, giving high attack complexity (AC:H) and availability-only impact (CVSS 5.1, C:N/I:N/A:H); no public exploit code has been identified at time of analysis.
Denial of service in OpenPrinting CUPS before 2.4.20 lets an actor holding @SYSTEM-level class-management privileges crash the cupsd scheduler by triggering a double-free in printer-class handling. The actor submits a CUPS-Add-Modify-Class request that replaces an existing class's member list and then fails subsequent validation, leaving pclass->printers as a dangling pointer, then issues a CUPS-Delete-Class request so cupsdDeletePrinter() frees the same allocation a second time. Impact is confined to availability (scheduler crash) with no confidentiality or integrity effect, and no public exploit identified at time of analysis - the @SYSTEM privilege prerequisite (PR:H) is the dominant limiting factor, keeping overall risk low even though the assessed vector is network-reachable (AV:N/AC:H) when the CUPS listener is exposed.
Resource exhaustion in OpenPrinting CUPS (all versions through 2.4.20) lets an authorized print submitter stall the scheduler's job-timeout handling, so incomplete jobs accumulate until MaxJobs is exhausted and further legitimate print submissions are rejected. The defect in cupsdCheckJobs() suppresses submission-timeout processing for every pending job whenever any client connection holds an in-flight Send-Document operation, without matching that connection to the job being examined (CWE-770); per the independent assessment the attack surface is AV:N/AC:L with PR:L, meaning the attacker must already be a principal permitted to reach the IPP/HTTP service and allowed to submit Create-Job requests, not an anonymous outsider. Impact is transient and self-correcting once the held connection closes, with no persistence, data exposure, or effect beyond blocking new jobs; no public exploit code and no CISA KEV activity were identified at time of analysis, and the independent assessment rates this as a genuinely low-priority issue.
Ubuntu Linux carries CVE-2026-55453, a security issue that has so far been reported only by the vendor (Ubuntu) with no published description, no CVSS score or vector, no CWE classification, and no CPE or version data. Because the flaw is entirely undisclosed, it is not possible to state which package, subsystem, or Ubuntu release is affected, what an attacker would need to reach it, or what the resulting impact would be. There is no public exploit identified at time of analysis, no KEV listing, no EPSS score, and no confirmed patch availability, so the item should be treated as an unassessed placeholder pending the corresponding Ubuntu Security Notice (USN) and NVD entry.
CVE-2026-55480 is currently recorded only against Ubuntu Linux, with the sole intelligence signal being that the entry was reported by vendor:ubuntu, meaning Canonical's security team is the originating source for the record. The supplied data contains no description, no CVSS score or vector, no CWE classification, no CPE strings, and no version ranges, so the specific component, attack vector, authentication requirement, and impact cannot be characterized at this time. No public exploit code has been identified at time of analysis, and no CISA KEV listing is present, but this reflects the absence of data rather than a confirmed negative - defenders should treat the entry as unassessed and pull the authoritative record from the Ubuntu CVE tracker and NVD before drawing any risk conclusion.
CVE-2026-61702 is recorded in this dataset solely as a vendor-sourced report from Ubuntu, with no description, no CVSS score or vector, no CWE mapping, and no CPE data, so the specific Ubuntu package, upstream component, and version range involved cannot be identified. Because the description is '[Unknown description]', no attacker capability, impact, or exploitation precondition can be stated, and the EPSS, KEV, and proof-of-concept signals are all absent - there is no evidence of active exploitation and no public exploit code identified at time of analysis, though that absence reflects missing data rather than a positive finding of safety. Risk cannot be meaningfully assessed from the provided data because nearly every decision signal is absent; prioritization should be deferred until the Ubuntu Security Notice and canonical CVE description are retrieved.
OpenPrinting CUPS before version 2.4.17 allows network-adjacent attackers to read up to 176 bytes of stack memory via a crafted SNMP response sent to the CUPS SNMP backend, with leaked data visible to authenticated users through IPP Get-Printer-Attributes responses and the web interface. The vulnerability requires adjacency on the network but no authentication, making it a low-severity information disclosure risk in environments where SNMP-enabled printers are accessible from untrusted networks.
Local denial of service and potential remote code execution in OpenPrinting CUPS 2.4.16 and prior occurs when the scheduler (cupsd) deletes temporary printers without expiring associated subscriptions, leaving dangling pointers in memory that are subsequently dereferenced. An unauthenticated local attacker can crash the cupsd daemon or, with heap grooming techniques, achieve arbitrary code execution on systems running affected CUPS versions.
Denial of service in OpenPrinting CUPS 2.4.16 and prior allows unprivileged local users to crash the cupsd root process via integer underflow in _ppdCreateFromIPP() by supplying a negative job-password-supported IPP attribute, which wraps to a large size_t value and triggers a stack buffer overflow in memset(). When combined with systemd's automatic restart mechanism, an attacker can sustain repeated crashes without requiring elevated privileges or user interaction.
Unauthenticated remote code execution in OpenPrinting CUPS 2.4.16 and earlier allows attackers to send print jobs to shared PostScript queues without authentication, exploit a newline injection vulnerability in page-border parameter handling, and execute arbitrary binaries as the lp user by chaining a follow-up raw print job. CISA KEV status and active exploitation confirmation not provided; no publicly available patches identified at publication.
Heap-based buffer overflow in OpenPrinting CUPS scheduler versions 2.4.16 and prior allows unauthenticated remote attackers to trigger a denial of service condition by crafting malicious job attributes that overflow buffers during filter option string construction. With a CVSS score of 5.3 and network accessibility, this vulnerability impacts availability on exposed CUPS instances; no public exploit code or vendor patch has been released as of publication.
Path traversal in OpenPrinting CUPS RSS notifier (versions 2.4.16 and prior) allows unauthenticated remote IPP clients to write arbitrary files outside the intended CacheDir/rss directory via a crafted notify-recipient-uri parameter. By exploiting default group-writable permissions on CacheDir, attackers can overwrite critical state files such as job.cache, causing the CUPS scheduler to fail parsing job queues and resulting in loss of previously queued print jobs. No public exploit code or vendor patch is currently available, though the vulnerability is demonstrated with proof-of-concept exploitation.
Local privilege escalation in OpenPrinting CUPS 2.4.16 and prior allows unprivileged users to bypass authentication and create arbitrary file overwrites as root by coercing cupsd into issuing reusable Authorization tokens and leveraging printer-sharing policies to persist file:// URIs that bypass FileDevice restrictions. A proof-of-concept demonstrates root command execution via sudoers file modification, and the vulnerability is confirmed by the presence of public exploit code.
CUPS daemon (cupsd) versions 2.4.16 and earlier authenticate users via case-insensitive username comparison, allowing an authenticated high-privileged user to bypass authorization controls by submitting requests under a username that differs only in case from an authorized user, gaining access to restricted printing operations. No public exploit code has been identified, and patches were not available at the time of initial disclosure, though a upstream commit indicates a fix may have been prepared.
OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Rated medium severity (CVSS 6.0), this vulnerability is low attack complexity. Public exploit code available.
OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Rated medium severity (CVSS 5.1), this vulnerability is no authentication required. Public exploit code available.
cups-filters contains backends, filters, and other software required to get the cups printing service working on operating systems other than macos. Rated low severity (CVSS 3.3), this vulnerability is low attack complexity. Public exploit code available.
cups-filters contains backends, filters, and other software required to get the cups printing service working on operating systems other than macos. Rated medium severity (CVSS 4.0), this vulnerability is no authentication required, low attack complexity. Public exploit code available.
CUPS is a standards-based, open-source printing system, and `libcupsfilters` contains the code of the filters of the former `cups-filters` package as library functions to be used for the data format. Rated low severity (CVSS 3.7). Public exploit code available.
OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Rated medium severity (CVSS 6.5), this vulnerability is no authentication required, low attack complexity. Public exploit code available.
OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Rated high severity (CVSS 8.0), this vulnerability is no authentication required, low attack complexity. Public exploit code available.
A stack based buffer overflow vulnerability is present in OpenPrinting ippusbxd 1.34. Rated medium severity (CVSS 6.4), this vulnerability is no authentication required. Public exploit code available and no vendor patch available.
Due to failure in validating the length provided by an attacker-crafted PPD PostScript document, CUPS and libppd are susceptible to a heap-based buffer overflow and possibly code execution. Rated high severity (CVSS 7.0), this vulnerability is no authentication required. Public exploit code available and no vendor patch available.
OpenPrinting CUPS is a standards-based, open source printing system for Linux and other Unix-like operating systems. Rated high severity (CVSS 7.1), this vulnerability is low attack complexity. Public exploit code available.
cpdb-libs provides frontend and backend libraries for the Common Printing Dialog Backends (CPDB) project. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
OpenPrinting CUPS is an open source printing system. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A logic issue was addressed with improved state management. Rated medium severity (CVSS 6.7), this vulnerability is low attack complexity.
Alpine Linux has issued a fix for an unspecified vulnerability in the CUPS printing package, addressed in cups version 2.4.20-r0. The advisory provides no description of the flaw, its impact, or attack vector; consequently, the risk cannot be meaningfully quantified, and authentication requirements are not confirmed from available data. No public exploit code has been identified at time of analysis, and there is no indication of active exploitation (CISA KEV).