# cve.now: Openprinting

The newest entries naming Openprinting as an affected vendor (up to 200), of 33 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-61702](https://cve.now/CVE-2026-61702.md): OpenPrinting CUPS: root-side banner file disclosure (CVSS 5.3)
- [CVE-2026-55453](https://cve.now/CVE-2026-55453.md): CUPS ipp backend status-line injection can update queue PPD and lead to conditional RCE as lp via foomatic-rip (CVSS 3.3)
- [CVE-2026-55480](https://cve.now/CVE-2026-55480.md): CUPS copy\_model() creates a predictable PPD tempfile without O\_EXCL/O\_NOFOLLOW (symlink TOCTOU, lp → root) (CVSS 5.7)
- [CVE-2026-55467](https://cve.now/CVE-2026-55467.md): CUPS fax option values bypass the CVE-2026-34980 control-character sanitizer (incomplete fix) (CVSS 2.5)
- [CVE-2026-107890](https://cve.now/CVE-2026-107890.md): OpenPrinting CUPS before 2.4.20 contains a NULL pointer dereference caused by repeated IPP group tags in job-creation requests. (CVSS 3.3)
- [CVE-2026-107888](https://cve.now/CVE-2026-107888.md): OpenPrinting CUPS before 2.4.20 contains a NULL pointer dereference in cupsdCheckJobs() when a job marked job-held-on-create refers to a tem (CVSS 5.1)
- [CVE-2026-107886](https://cve.now/CVE-2026-107886.md): OpenPrinting CUPS before 2.4.20 contains a double-free in printer-class management. (CVSS 2.3)
- [CVE-2026-107885](https://cve.now/CVE-2026-107885.md): OpenPrinting CUPS through 2.4.20 contains a resource-exhaustion vulnerability in the submission-timeout handling of cupsdCheckJobs(). (CVSS 3.3)
- [CVE-2026-41079](https://cve.now/CVE-2026-41079.md): OpenPrinting CUPS: Heap out-of-bounds read in SNMP supply-level polling leaks stack memory to authenticated users (CVSS 4.3)
- [CVE-2026-39316](https://cve.now/CVE-2026-39316.md): CUPS has a use-after-free in \`cupsdDeleteTemporaryPrinters\` via dangling subscription pointer (CVSS 4.0)
- [CVE-2026-39314](https://cve.now/CVE-2026-39314.md): CUPS has an integer underflow in \`\_ppdCreateFromIPP\` causes root cupsd crash via negative \`job-password-supported\` (CVSS 4.0)
- [CVE-2026-34980](https://cve.now/CVE-2026-34980.md): OpenPrinting CUPS: Shared PostScript queue lets anonymous Print-Job requests reach \`lp\` code execution over the network (CVSS 6.1)
- [CVE-2026-34979](https://cve.now/CVE-2026-34979.md): OpenPrinting CUPS: Heap overflow in \`get\_options()\` (CVSS 5.3)
- [CVE-2026-34978](https://cve.now/CVE-2026-34978.md): OpenPrinting CUPS: Path traversal in RSS notify-recipient-uri enables file write outside CacheDir/rss (and clobbering of job.cache) (CVSS 6.5)
- [CVE-2026-34990](https://cve.now/CVE-2026-34990.md): OpenPrinting CUPS: Local print admin token disclosure using temporary printers (CVSS 5.0)
- [CVE-2026-27447](https://cve.now/CVE-2026-27447.md): OpenPrinting CUPS: Authorization bypass via case-insensitive group-member lookup (CVSS 4.8)
- [CVE-2025-58436](https://cve.now/CVE-2025-58436.md): OpenPrinting CUPS slow client can halt cupsd, leading to a possible DoS attack (CVSS 5.1)
- [CVE-2025-61915](https://cve.now/CVE-2025-61915.md): OpenPrinting CUPS vulnerable to stack based out-of-bound write (CVSS 6.0)
- [CVE-2025-64524](https://cve.now/CVE-2025-64524.md): CUPS rastertopclx Filter Vulnerable to Heap Buffer Overflow Leading to Potential Arbitrary Code Execution (CVSS 3.3)
- [CVE-2025-64503](https://cve.now/CVE-2025-64503.md): \[BIGSLEEP-434615384\] cups-filters 1.x: out of bounds write in pdftoraster (CVSS 4.0)
- [CVE-2025-57812](https://cve.now/CVE-2025-57812.md): \[BIGSLEEP-434612419\] CUPS-Filters has heap-buffer-overflow write in \`cfImageLut()\` (CVSS 3.7)
- [CVE-2025-58364](https://cve.now/CVE-2025-58364.md): cups: Remote DoS via null dereference (CVSS 6.5)
- [CVE-2025-58060](https://cve.now/CVE-2025-58060.md): cups has Authentication bypass with AuthType Negotiate (CVSS 8.0)
- [CVE-2024-45062](https://cve.now/CVE-2024-45062.md): A stack based buffer overflow vulnerability is present in OpenPrinting ippusbxd 1.34. (CVSS 6.4)
- [CVE-2024-47175](https://cve.now/CVE-2024-47175.md): libppd's ppdCreatePPDFromIPP2 function does not sanitize IPP attributes when creating the PPD buffer (CVSS 8.6)
- [CVE-2024-47076](https://cve.now/CVE-2024-47076.md): libcupsfilters's cfGetPrinterAttributes5 does not validate IPP attributes returned from an IPP server (CVSS 8.6)
- [CVE-2024-47176](https://cve.now/CVE-2024-47176.md): cups-browsed binds to \`INADDR\_ANY:631\`, trusting any packet from any source (CVSS 5.3)
- [CVE-2024-35235](https://cve.now/CVE-2024-35235.md): Cupsd Listen arbitrary chmod 0140777 (CVSS 4.4)
- [CVE-2023-4504](https://cve.now/CVE-2023-4504.md): OpenPrinting CUPS/libppd Postscript Parsing Heap Overflow (CVSS 7.0)
- [CVE-2023-34241](https://cve.now/CVE-2023-34241.md): CUPS vulnerable to use-after-free in cupsdAcceptClient() (CVSS 5.3)
- [CVE-2023-34095](https://cve.now/CVE-2023-34095.md): cpdb-libs vulnerable to buffer overflows via scanf (CVSS 9.8)
- [CVE-2023-32324](https://cve.now/CVE-2023-32324.md): OpenPrinting CUPS vulnerable to heap buffer overflow (CVSS 7.5)
- [CVE-2023-24805](https://cve.now/CVE-2023-24805.md): Command injection in cups-filters (CVSS 8.8)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/openprinting
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.