Log in Start free

Vulnerability · Published Oct 9, 2026 · Assigned by redhat

CVE-2026-107655Cups: null pointer dereference via embedded job ticket comments allows remote denial of service

Medium 4.0

In plain English

A medium-severity null pointer dereference in Red Hat Enterprise Linux 10 from Red Hat. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 17% of all known vulnerabilities).

Severity (CVSS 3.1)4.0Medium
Exploit odds (30 days)0.3%top 83.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

A flaw was found in CUPS. When processing embedded job ticket comments within documents, the service improperly handles specific IPP attributes, causing an unhandled null pointer dereference. An unauthenticated attacker permitted to submit jobs to a shared printer queue can send a crafted Internet Printing Protocol (IPP) request to crash the print daemon, resulting in a temporary Denial of Service (DoS) for all printing services.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12cupsno fix listedDEBIAN-CVE-2026-107655
Debian:13cupsno fix listedDEBIAN-CVE-2026-107655
Debian:14cupsno fix listedDEBIAN-CVE-2026-107655
Ubuntu:22.04:LTScupsno fix listedUBUNTU-CVE-2026-107655
Ubuntu:24.04:LTScupsno fix listedUBUNTU-CVE-2026-107655
Ubuntu:26.04:LTScupsno fix listedUBUNTU-CVE-2026-107655
Ubuntu:26.10cupsno fix listedUBUNTU-CVE-2026-107655

Affected products (as reported)

VendorProductVersions
Red Hat Red Hat Hardened Images see references
Red Hat Red Hat Enterprise Linux 10 see references
Red Hat Red Hat Enterprise Linux 6 see references
Red Hat Red Hat Enterprise Linux 7 see references
Red Hat Red Hat Enterprise Linux 8 see references
Red Hat Red Hat Enterprise Linux 9 see references

Weakness: CWE-476 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References