OpenPrinting CUPS

• CVE-2026-61702 Medium 5.3 OpenPrinting CUPS: root-side banner file disclosure 0.4%
• CVE-2026-55453 Low 3.3 CUPS ipp backend status-line injection can update queue PPD and lead to conditional RCE as lp via foomatic-rip 0.2%
• CVE-2026-55480 Medium 5.7 CUPS copy_model() creates a predictable PPD tempfile without O_EXCL/O_NOFOLLOW (symlink TOCTOU, lp → root) 0.2%
• CVE-2026-55467 Low 2.5 CUPS fax option values bypass the CVE-2026-34980 control-character sanitizer (incomplete fix) 0.2%
• CVE-2026-107890 Low 3.3 OpenPrinting CUPS before 2.4.20 contains a NULL pointer dereference caused by repeated IPP group tags in job-creation requests. IPP parsing creates unnamed separator attributes with IPP_TAG_ZERO, but 0.1%
• CVE-2026-107888 Medium 5.1 OpenPrinting CUPS before 2.4.20 contains a NULL pointer dereference in cupsdCheckJobs() when a job marked job-held-on-create refers to a temporary printer that has been automatically deleted. Temporar 0.1%
• CVE-2026-107886 Low 2.3 OpenPrinting CUPS before 2.4.20 contains a double-free in printer-class management. When CUPS-Add-Modify-Class replaces an existing class member list, add_class() frees pclass->printers without cleari 0.2%
• CVE-2026-107885 Low 3.3 OpenPrinting CUPS through 2.4.20 contains a resource-exhaustion vulnerability in the submission-timeout handling of cupsdCheckJobs(). The scheduler suppresses timeout processing for all pending jobs w 0.1%
• CVE-2026-41079 Medium 4.3 OpenPrinting CUPS: Heap out-of-bounds read in SNMP supply-level polling leaks stack memory to authenticated users 0.4%
• CVE-2026-39316 Medium 4.0 CUPS has a use-after-free in `cupsdDeleteTemporaryPrinters` via dangling subscription pointer 0.2%
• CVE-2026-39314 Medium 4.0 CUPS has an integer underflow in `_ppdCreateFromIPP` causes root cupsd crash via negative `job-password-supported` 0.2%
• CVE-2026-34980 Medium 6.1 OpenPrinting CUPS: Shared PostScript queue lets anonymous Print-Job requests reach `lp` code execution over the network 1.7%
• CVE-2026-34979 Medium 5.3 OpenPrinting CUPS: Heap overflow in `get_options()` 0.4%
• CVE-2026-34978 Medium 6.5 OpenPrinting CUPS: Path traversal in RSS notify-recipient-uri enables file write outside CacheDir/rss (and clobbering of job.cache) 0.4%
• CVE-2026-34990 High 7.8 OpenPrinting CUPS: Local print admin token disclosure using temporary printers 0.3%
• CVE-2026-27447 Medium 4.8 OpenPrinting CUPS: Authorization bypass via case-insensitive group-member lookup 0.3%
• CVE-2025-58436 Medium 5.1 OpenPrinting CUPS slow client can halt cupsd, leading to a possible DoS attack 0.2%
• CVE-2025-61915 Medium 6.0 OpenPrinting CUPS vulnerable to stack based out-of-bound write 0.5%
• CVE-2025-58364 Medium 6.5 cups: Remote DoS via null dereference 1.2%
• CVE-2025-58060 High 8.0 cups has Authentication bypass with AuthType Negotiate 1.0%
• CVE-2024-35235 Medium 4.4 Cupsd Listen arbitrary chmod 0140777 2.4%
• CVE-2023-4504 High 7.0 OpenPrinting CUPS/libppd Postscript Parsing Heap Overflow 0.6%
• CVE-2023-34241 Medium 5.3 CUPS vulnerable to use-after-free in cupsdAcceptClient() 1.4%
• CVE-2023-32324 High 7.5 OpenPrinting CUPS vulnerable to heap buffer overflow 1.5%