id	summary	reporter	owner	description	type	status	priority	milestone	component	version	severity	resolution	keywords	cc
23153	cups-2.4.17	Douglas R. Reno	SecurityAdvisory	"From oss-security:

{{{
https://heyitsas.im/posts/cups/ discloses:

    1. CVE-2026-34980: Shared PostScript queue lets anonymous Print-Job requests
            reach lp code execution over the network

    2. CVE-2026-34990: Local print admin token disclosure using temporary printers

    At a high level, in the first vulnerability, the attacker:

     1. Submits a malicious print job to a shared PostScript queue,
     2. Gets CUPS to treat attacker-controlled text as a trusted queue config by
        abusing a parsing bug, and
     3. Gets code execution as the CUPS service user, lp (vim in the PoC)

    And in the second vulnerability, the attacker:

     1. Uses any* unprivileged local user to set up a localhost listener,
     2. Creates a local printer object in CUPS, pointing it at the listener above,
     3. Gets CUPS to authenticate to it and captures the auth token,
     4. Creates another queue pointing at file:///... for the target rootful write,
     5. Uses the token to race against CUPS validation logic’s cleanup of the
        dangerous queue, and
     6. Writes what they want into the target file:///... (/etc/sudoers.d/... in
        the PoC)

    * any unprivileged local user that can bind on some TCP port and reach the
      local CUPS listener.

    Are you affected? + Mitigation

    The unauth’d RCE as lp (CVE-2026-34980) requires the CUPS server to be
    reachable over the network and expose a shared PostScript queue (these are
    legacy, but still used). This would be a deliberate config choice – realistic
    for, say, networked printing servers in your corporate environment, but not
    for your desktop (unless you for some reason set it up to be a remote printing
    server).

    The LPE to root file (over)write (CVE-2026-34990), on the other hand, works
    on the stock CUPS config.

    For both issues, the harm can be limited by a security module that confines
    CUPS (e.g., SELinux, AppArmor, etc.). So, if you run CUPS under a sane
    security policy (default on some distributions), the impact of both

    vulnerabilities is much less severe – e.g., no rootful file writes outside the paths CUPS is constrained to touch.


    As of 4/5/2026, there are public commits with fixes to both issues but no
    fixed release (latest being 2.4.16). So, your best mitigations are:

     * Do not expose CUPS over the network with a shared PostScript queue – or at all
     * If you must use a shared queue, require auth for job submissions to that queue
     * Make sure your CUPS runs under a reasonable AppArmor/SELinux/etc. policy,
       so that the impact is minimized even if you are targeted


Further details, including about how the bugs were found and the PoC can be
found in the blog post at https://heyitsas.im/posts/cups/ and the article at
https://www.theregister.com/2026/04/06/ai_agents_cups_server_rce/

The CUPS maintainers have published advisories for the above at:

 CVE-2026-34980:
   https://github.com/OpenPrinting/cups/security/advisories/GHSA-4852-v58g-6cwf

 CVE-2026-34990:
   https://github.com/OpenPrinting/cups/security/advisories/GHSA-c54j-2vqw-wpwp

Additionally, in the past week they've also published advisories for:

 CVE-2026-27447: Authorization bypass via case-insensitive group-member lookup
   https://github.com/OpenPrinting/cups/security/advisories/GHSA-v987-m8hp-phj9

 CVE-2026-34978: Path traversal in RSS notify-recipient-uri enables file write
   outside CacheDir/rss (and clobbering of job.cache)
   https://github.com/OpenPrinting/cups/security/advisories/GHSA-f53q-7mxp-9gcr

 CVE-2026-34979: Heap overflow in `get_options()`
   https://github.com/OpenPrinting/cups/security/advisories/GHSA-6qxf-7jx6-86fh

 CVE-2026-39314: Integer underflow in `_ppdCreateFromIPP` causes root cupsd
   crash via negative `job-password-supported`
   https://github.com/OpenPrinting/cups/security/advisories/GHSA-pp8w-2g52-7vj7

 CVE-2026-39316: Use-after-free in `cupsdDeleteTemporaryPrinters` via dangling
   subscription pointer
   https://github.com/OpenPrinting/cups/security/advisories/GHSA-pjv5-prqp-46rg

 <no CVE>: Out-of-bounds heap read in cupsdSetPrinterAttr marker-types parsing
   https://github.com/OpenPrinting/cups/security/advisories/GHSA-qfp8-9frx-5j48
}}}

Some more gnarly issues here unfortunately"	enhancement	closed	high	13.1	BOOK	git	medium	fixed