ALT-PU-2026-17821-1

BDU:2026-04785

HIGH7.6

Уязвимость демона cupsd сервера печати CUPS, позволяющая нарушителю выполнить произвольный код

Published: 2026-04-07Modified: 2026-09-21

CVSS 3.xHIGH 7.6

CVSS:3.x/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

CVSS 2.0HIGH 7.3

CVSS:2.0/AV:A/AC:L/Au:N/C:C/I:P/A:P

References

CVE-2026-105326

LOW2.5

An argument injection flaw was found in CUPS. When email notification is configured, the CUPS scheduler accepts printer subscription requests that supply a mailto notify-recipient-uri. The mailto notifier passes the recipient address to the configured sendmail program without ensuring it cannot be interpreted as command-line options. A remote attacker who can reach the CUPS service could supply a crafted recipient value starting with "-" to influence sendmail behavior. Successful exploitation depends on the installed mail transfer agent and CUPS network exposure, and may lead to execution of attacker-controlled commands with the privileges of the CUPS service user.

Published: 2026-10-05Modified: 2026-10-07

CVSS 3.xLOW 2.5

CVSS:3.x/CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

References

CVE-2026-34980

MEDIUM6.1

OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.16 and prior, in a network-exposed cupsd with a shared target queue, an unauthorized client can send a Print-Job to that shared PostScript queue without authentication. The server accepts a page-border value supplied as textWithoutLanguage, preserves an embedded newline through option escaping and reparse, and then reparses the resulting second-line PPD: text as a trusted scheduler control record. A follow-up raw print job can therefore make the server execute an attacker-chosen existing binary such as /usr/bin/vim as lp. At time of publication, there are no publicly available patches.

Published: 2026-04-03Modified: 2026-07-24

CVSS 3.xHIGH 7.5

CVSS:3.x/CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS 4.0MEDIUM 6.1

CVSS:4.0/CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

References

https://github.com/OpenPrinting/cups/security/advisories/GHSA-4852-v58g-6cwf

NONE

NONE

NONE

NONE

MEDIUM4.3

The cupsUTF32ToUTF8() function in CUPS's cups/transcode.c lacks a source-length bound and can read past the end of the source buffer, resulting in a heap out-of-bounds read. This is reachable via SNMP supply-description parsing in backend/snmp-supplies.c with attacker-controlled content.

Published: 2026-09-09Modified: 2026-09-11

CVSS 3.xMEDIUM 4.3

CVSS:3.x/CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References

CVE-2026-87876

LOW3.0

Two case-insensitive comparisons on request-derived usernames outside the main authorization path in CUPS's scheduler (printer ACL validation and private-attribute filtering) could allow bypass of username-based access controls in certain configurations.

Published: 2026-09-09Modified: 2026-09-21

CVSS 3.xLOW 3.0

CVSS:3.x/CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N

References

Package update cups in branch sisyphus

Closed issues (9)

Уязвимость демона cupsd сервера печати CUPS, позволяющая нарушителю выполнить произвольный код

The cupsUTF32ToUTF8() function in CUPS's cups/transcode.c lacks a source-length bound and can read past the end of the source buffer, resulting in a heap out-of-bounds read. This is reachable via SNMP supply-description parsing in backend/snmp-supplies.c with attacker-controlled content.

Two case-insensitive comparisons on request-derived usernames outside the main authorization path in CUPS's scheduler (printer ACL validation and private-attribute filtering) could allow bypass of username-based access controls in certain configurations.