OpenPrinting cups vulnerabilities

CVEs per yearBy the year they were published

1. 20233
2. 20241
3. 20254
4. 202616

Newest CVEs

• CVE-2026-61702

  OpenPrinting CUPS: root-side banner file disclosure

  OpenPrinting · cups

  Medium5.3
• CVE-2026-55453

  CUPS ipp backend status-line injection can update queue PPD and lead to conditional RCE as lp via foomatic-rip

  OpenPrinting · cups

  Low3.3
• CVE-2026-55480

  CUPS copy_model() creates a predictable PPD tempfile without O_EXCL/O_NOFOLLOW (symlink TOCTOU, lp → root)

  OpenPrinting · cups

  Medium5.7
• CVE-2026-55467

  CUPS fax option values bypass the CVE-2026-34980 control-character sanitizer (incomplete fix)

  OpenPrinting · cups

  Low2.5
• CVE-2026-107890

  OpenPrinting CUPS before 2.4.20 contains a NULL pointer dereference caused by repeated IPP group tags in job-creation requests. IPP parsing creates unnamed…

  OpenPrinting · CUPS

  Low3.3
• CVE-2026-107888

  OpenPrinting CUPS before 2.4.20 contains a NULL pointer dereference in cupsdCheckJobs() when a job marked job-held-on-create refers to a temporary printer that…

  OpenPrinting · CUPS

  Medium5.1
• CVE-2026-107886

  OpenPrinting CUPS before 2.4.20 contains a double-free in printer-class management. When CUPS-Add-Modify-Class replaces an existing class member list,…

  OpenPrinting · CUPS

  Low2.3
• CVE-2026-107885

  OpenPrinting CUPS through 2.4.20 contains a resource-exhaustion vulnerability in the submission-timeout handling of cupsdCheckJobs(). The scheduler suppresses…

  OpenPrinting · CUPS

  Low3.3
• CVE-2026-41079

  OpenPrinting CUPS: Heap out-of-bounds read in SNMP supply-level polling leaks stack memory to authenticated users

  OpenPrinting · cups

  Medium4.3
• CVE-2026-39316

  CUPS has a use-after-free in `cupsdDeleteTemporaryPrinters` via dangling subscription pointer

  OpenPrinting · cups

  Medium4.0