OpenPrinting cups
24 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-61702 | < 2.4.20 | OpenPrinting CUPS: root-side banner file disclosure | MEDIUM 5.3 | 0.4 % | ||
| CVE-2026-55453 | < 2.4.20 | CUPS ipp backend status-line injection can update queue PPD and lead to conditional RCE as lp via foomatic-rip | LOW 3.3 | 0.2 % | ||
| CVE-2026-55480 | < 2.4.20 | CUPS copy_model() creates a predictable PPD tempfile without O_EXCL/O_NOFOLLOW (symlink TOCTOU, lp → root) | MEDIUM 5.7 | 0.2 % | ||
| CVE-2026-55467 | < 2.4.20 | CUPS fax option values bypass the CVE-2026-34980 control-character sanitizer (incomplete fix) | LOW 2.5 | 0.2 % | ||
| CVE-2026-107890 | < 2.4.20 | OpenPrinting CUPS before 2.4.20 contains a NULL pointer dereference caused by repeated IPP group tags in job-creation requests. IPP parsing | MEDIUM 5.5 | 0.1 % | ||
| CVE-2026-107888 | < 2.4.20 | OpenPrinting CUPS before 2.4.20 contains a NULL pointer dereference in cupsdCheckJobs() when a job marked job-held-on-create refers to a tem | MEDIUM 5.5 | 0.1 % | ||
| CVE-2026-107886 | 1.4.8 – < 2.4.20 | OpenPrinting CUPS before 2.4.20 contains a double-free in printer-class management. When CUPS-Add-Modify-Class replaces an existing class me | MEDIUM 6.5 | 0.2 % | ||
| CVE-2026-107885 | ≤ 2.4.20 | OpenPrinting CUPS through 2.4.20 contains a resource-exhaustion vulnerability in the submission-timeout handling of cupsdCheckJobs(). The sc | MEDIUM 5.5 | 0.1 % | ||
| CVE-2026-41079 | < 2.4.17 | OpenPrinting CUPS: Heap out-of-bounds read in SNMP supply-level polling leaks stack memory to authenticated users | MEDIUM 5.4 | 0.4 % | ||
| CVE-2026-39316 | <= 2.4.16 | CUPS has a use-after-free in `cupsdDeleteTemporaryPrinters` via dangling subscription pointer | MEDIUM 6.2 | 0.2 % | ||
| CVE-2026-39314 | <= 2.4.16 | CUPS has an integer underflow in `_ppdCreateFromIPP` causes root cupsd crash via negative `job-password-supported` | MEDIUM 6.2 | 0.2 % | ||
| CVE-2026-34980 | <= 2.4.16 | OpenPrinting CUPS: Shared PostScript queue lets anonymous Print-Job requests reach `lp` code execution over the network | MEDIUM 6.1 | 1.6 % | ||
| CVE-2026-34979 | <= 2.4.16 | OpenPrinting CUPS: Heap overflow in `get_options()` | MEDIUM 5.3 | 0.4 % | ||
| CVE-2026-34978 | <= 2.4.16 | OpenPrinting CUPS: Path traversal in RSS notify-recipient-uri enables file write outside CacheDir/rss (and clobbering of job.cache) | MEDIUM 6.5 | 0.4 % | ||
| CVE-2026-34990 | <= 2.4.16 | OpenPrinting CUPS: Local print admin token disclosure using temporary printers | MEDIUM 5.0 | 0.3 % | ||
| CVE-2026-27447 | <= 2.4.16 | OpenPrinting CUPS: Authorization bypass via case-insensitive group-member lookup | MEDIUM 6.3 | 0.3 % | ||
| CVE-2025-58436 | < 2.4.15 | OpenPrinting CUPS slow client can halt cupsd, leading to a possible DoS attack | MEDIUM 5.5 | 0.2 % | ||
| CVE-2025-61915 | < 2.4.15 | OpenPrinting CUPS vulnerable to stack based out-of-bound write | MEDIUM 6.7 | 0.5 % | ||
| CVE-2025-58364 | < 2.4.13 | cups: Remote DoS via null dereference | MEDIUM 6.5 | 1.2 % | ||
| CVE-2025-58060 | < 2.4.13 | cups has Authentication bypass with AuthType Negotiate | HIGH 8.0 | 1.0 % | ||
| CVE-2024-35235 | <= 2.4.8 | Cupsd Listen arbitrary chmod 0140777 | MEDIUM 6.7 | 2.4 % | ||
| CVE-2023-4504 | < 2.4.6 | OpenPrinting CUPS/libppd Postscript Parsing Heap Overflow | HIGH 7.0 | 0.6 % | ||
| CVE-2023-34241 | >= 2.0.0, < 2.4.6 | CUPS vulnerable to use-after-free in cupsdAcceptClient() | HIGH 7.1 | 1.4 % | ||
| CVE-2023-32324 | <= 2.4.2 | OpenPrinting CUPS vulnerable to heap buffer overflow | HIGH 7.5 | 1.5 % |