Openprinting vulnerabilities
33 CVEs and advisories name Openprinting as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-61702OpenPrinting CUPS: root-side banner file disclosure
- CVE-2026-55453CUPS ipp backend status-line injection can update queue PPD and lead to conditional RCE as lp via foomatic-rip
- CVE-2026-55480CUPS copy_model() creates a predictable PPD tempfile without O_EXCL/O_NOFOLLOW (symlink TOCTOU, lp → root)
- CVE-2026-55467CUPS fax option values bypass the CVE-2026-34980 control-character sanitizer (incomplete fix)
- CVE-2026-107890OpenPrinting CUPS before 2.4.20 contains a NULL pointer dereference caused by repeated IPP group tags in job-creation requests.
- CVE-2026-107888OpenPrinting CUPS before 2.4.20 contains a NULL pointer dereference in cupsdCheckJobs() when a job marked job-held-on-create refers to a tem
- CVE-2026-107886OpenPrinting CUPS before 2.4.20 contains a double-free in printer-class management.
- CVE-2026-107885OpenPrinting CUPS through 2.4.20 contains a resource-exhaustion vulnerability in the submission-timeout handling of cupsdCheckJobs().
- CVE-2026-41079OpenPrinting CUPS: Heap out-of-bounds read in SNMP supply-level polling leaks stack memory to authenticated users
- CVE-2026-39316CUPS has a use-after-free in `cupsdDeleteTemporaryPrinters` via dangling subscription pointer
- CVE-2026-39314CUPS has an integer underflow in `_ppdCreateFromIPP` causes root cupsd crash via negative `job-password-supported`
- CVE-2026-34980OpenPrinting CUPS: Shared PostScript queue lets anonymous Print-Job requests reach `lp` code execution over the network
- CVE-2026-34979OpenPrinting CUPS: Heap overflow in `get_options()`
- CVE-2026-34978OpenPrinting CUPS: Path traversal in RSS notify-recipient-uri enables file write outside CacheDir/rss (and clobbering of job.cache)
- CVE-2026-34990OpenPrinting CUPS: Local print admin token disclosure using temporary printers
- CVE-2026-27447OpenPrinting CUPS: Authorization bypass via case-insensitive group-member lookup
- CVE-2025-58436OpenPrinting CUPS slow client can halt cupsd, leading to a possible DoS attack
- CVE-2025-61915OpenPrinting CUPS vulnerable to stack based out-of-bound write
- CVE-2025-64524CUPS rastertopclx Filter Vulnerable to Heap Buffer Overflow Leading to Potential Arbitrary Code Execution
- CVE-2025-64503[BIGSLEEP-434615384] cups-filters 1.x: out of bounds write in pdftoraster
- CVE-2025-57812[BIGSLEEP-434612419] CUPS-Filters has heap-buffer-overflow write in `cfImageLut()`
- CVE-2025-58364cups: Remote DoS via null dereference
- CVE-2025-58060cups has Authentication bypass with AuthType Negotiate
- CVE-2024-45062A stack based buffer overflow vulnerability is present in OpenPrinting ippusbxd 1.34.
- CVE-2024-47175libppd's ppdCreatePPDFromIPP2 function does not sanitize IPP attributes when creating the PPD buffer
- CVE-2024-47076libcupsfilters's cfGetPrinterAttributes5 does not validate IPP attributes returned from an IPP server
- CVE-2024-47176cups-browsed binds to `INADDR_ANY:631`, trusting any packet from any source
- CVE-2024-35235Cupsd Listen arbitrary chmod 0140777
- CVE-2023-4504OpenPrinting CUPS/libppd Postscript Parsing Heap Overflow
- CVE-2023-34241CUPS vulnerable to use-after-free in cupsdAcceptClient()