CVE-2026-107890

OpenPrinting CUPS before 2.4.20 contains a NULL pointer dereference caused by repeated IPP group tags in job-creation requests. IPP parsing creates unnamed separator attributes with IPPTAGZERO, but addjob converts these separators to IPPTAGJOB. During job startup, getoptions/ipplength subsequentl...