OpenPrinting cups.

OpenPrinting CUPS: root-side banner file disclosure

• OpenPrinting cups
• Path traversal

CUPS ipp backend status-line injection can update queue PPD and lead to conditional RCE as lp via foomatic-rip

• OpenPrinting cups
• Other injection
• Command injection

CUPS copy_model() creates a predictable PPD tempfile without O_EXCL/O_NOFOLLOW (symlink TOCTOU, lp → root)

• OpenPrinting cups
• Path traversal
• CWE-377

CUPS fax option values bypass the CVE-2026-34980 control-character sanitizer (incomplete fix)

• OpenPrinting cups
• Other injection
• Code injection

NULL pointer dereference in OpenPrinting CUPS

• OpenPrinting CUPS
• Memory corruption

NULL pointer dereference in OpenPrinting CUPS

• OpenPrinting CUPS
• Memory corruption

Double free in OpenPrinting CUPS

• OpenPrinting CUPS
• Memory corruption

Resource allocation without limits in OpenPrinting CUPS

• OpenPrinting CUPS
• Denial of service

OpenPrinting CUPS: Heap out-of-bounds read in SNMP supply-level polling leaks stack memory to authenticated users

• OpenPrinting cups
• Memory corruption
• Information disclosure

CUPS has a use-after-free in `cupsdDeleteTemporaryPrinters` via dangling subscription pointer

• OpenPrinting cups
• Memory corruption

CUPS has an integer underflow in `_ppdCreateFromIPP` causes root cupsd crash via negative `job-password-supported`

• OpenPrinting cups
• Memory corruption

OpenPrinting CUPS: Shared PostScript queue lets anonymous Print-Job requests reach `lp` code execution over the network

• OpenPrinting cups
• CWE-20

OpenPrinting CUPS: Heap overflow in `get_options()`

• OpenPrinting cups
• Memory corruption

OpenPrinting CUPS: Path traversal in RSS notify-recipient-uri enables file write outside CacheDir/rss (and clobbering of job.cache)

• OpenPrinting cups
• Path traversal

OpenPrinting CUPS: Local print admin token disclosure using temporary printers

• OpenPrinting cups
• Authentication bypass

OpenPrinting CUPS: Authorization bypass via case-insensitive group-member lookup

• OpenPrinting cups
• Broken access control

OpenPrinting CUPS slow client can halt cupsd, leading to a possible DoS attack

• OpenPrinting cups
• Denial of service

OpenPrinting CUPS vulnerable to stack based out-of-bound write

• OpenPrinting cups
• Memory corruption
• CWE-129

cups: Remote DoS via null dereference

• OpenPrinting cups
• Memory corruption
• CWE-20

cups has Authentication bypass with AuthType Negotiate

• OpenPrinting cups
• Authentication bypass

Cupsd Listen arbitrary chmod 0140777

• OpenPrinting cups
• Path traversal
• CWE-252

OpenPrinting CUPS/libppd Postscript Parsing Heap Overflow

• OpenPrinting CUPS
• OpenPrinting libppd
• Memory corruption

CUPS vulnerable to use-after-free in cupsdAcceptClient()

• OpenPrinting cups
• Memory corruption

OpenPrinting CUPS vulnerable to heap buffer overflow

• OpenPrinting cups
• Memory corruption