CVE-2026-34980

OpenPrinting CUPS (versions 2.4.16 and earlier) is impacted by CVE-2026-34980. In a network-exposed cupsd with a shared target queue, an unauthenticated client can submit a Print-Job, causing the server to process a text-within-PPD that leads to executing an attacker-chosen binary (e.g., /usr/bin...

CVE-2026-34978

OpenPrinting CUPS vulnerability CVE-2026-34978 involves a path traversal flaw in the RSS notifier (notify-recipient-uri) that affects versions

CVE-2026-39316

OpenPrinting CUPS contains a use-after-free in the cupsd scheduler when deleting temporary printers. In cupsdDeleteTemporaryPrinters(), cupsdDeletePrinter() is called without expiring subscriptions that reference the printer, leaving cupsd_subscription_t.dest as a dangling pointer to freed memor...

CVE-2026-34990

OpenPrinting CUPS (OpenPrinting CUPS) CVE-2026-34990 affects versions 2.4.16 and earlier. A local unprivileged user can coerce cupsd to authenticate to an attacker-controlled localhost IPP service using a reusable Authorization: Local token, enabling /admin/ requests on localhost. By combining CU...

CVE-2026-27447

OpenPrinting CUPS (cupsd) contains an authorization bypass in versions 2.4.16 and earlier due to case-insensitive username comparison during authorization checks. This allows an unprivileged user to access restricted operations by using a username that differs only in case from an authorized user...

CVE-2026-39314

OpenPrinting CUPS (CVE-2026-39314) is vulnerable in versions 2.4.16 and prior. The root cause is an integer underflow in _ppdCreateFromIPP (cups/ppd-cache.c): a negative job-password-supported IPP attribute passes bounds checks, is cast to size_t, and is used as a length in memset() on a 33-byte ...

CVE-2026-34979

OpenPrinting CUPS contains a heap-based buffer overflow in the CUPS scheduler’s get_options() when building filter option strings from job attributes, affecting versions 2.4.16 and earlier. The vulnerability is currently unpatched publicly at publication. The CVSS metrics indicate Network attack ...