What’s Vulnerable › Products

OpenPrinting cups vulnerabilities

25 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 20 published in the last 12 months.

Check whether your OpenPrinting cups version is affected

Latest OpenPrinting cups vulnerabilities

• CVE-2026-61702 — OpenPrinting CUPS: root-side banner file disclosure (CVSS 5.3)
• CVE-2026-55480 — CUPS copy_model() creates a predictable PPD tempfile without O_EXCL/O_NOFOLLOW (symlink TOCTOU, lp → root) (CVSS 5.7)
• CVE-2026-55467 — CUPS fax option values bypass the CVE-2026-34980 control-character sanitizer (incomplete fix) (CVSS 2.5)
• CVE-2026-55453 — CUPS ipp backend status-line injection can update queue PPD and lead to conditional RCE as lp via foomatic-rip (CVSS 3.3)
• CVE-2026-107890 — (CVSS 5.5)
• CVE-2026-107888 — (CVSS 5.5)
• CVE-2026-107886 — (CVSS 6.5)
• CVE-2026-107885 — (CVSS 5.5)
• CVE-2026-41079 — OpenPrinting CUPS: Heap out-of-bounds read in SNMP supply-level polling leaks stack memory to authenticated users (CVSS 5.4)
• CVE-2026-39316 — CUPS has a use-after-free in `cupsdDeleteTemporaryPrinters` via dangling subscription pointer (CVSS 6.2)
• CVE-2026-39314 — CUPS has an integer underflow in `_ppdCreateFromIPP` causes root cupsd crash via negative `job-password-supported` (CVSS 6.2)
• CVE-2026-34990 — OpenPrinting CUPS: Local print admin token disclosure using temporary printers (CVSS 7.8)
• CVE-2026-34980 — OpenPrinting CUPS: Shared PostScript queue lets anonymous Print-Job requests reach `lp` code execution over the network (CVSS 7.5)
• CVE-2026-34979 — OpenPrinting CUPS: Heap overflow in `get_options()` (CVSS 5.3)
• CVE-2026-34978 — OpenPrinting CUPS: Path traversal in RSS notify-recipient-uri enables file write outside CacheDir/rss (and clobbering of job.cache) (CVSS 6.5)
• CVE-2026-27447 — OpenPrinting CUPS: Authorization bypass via case-insensitive group-member lookup (CVSS 6.3)
• CVE-2025-61915 — OpenPrinting CUPS vulnerable to stack based out-of-bound write (CVSS 6.7)
• CVE-2025-58436 — OpenPrinting CUPS slow client can halt cupsd, leading to a possible DoS attack (CVSS 5.5)
• CVE-2025-58364 — cups: Remote DoS via null dereference (CVSS 6.5)
• CVE-2025-58060 — cups has Authentication bypass with AuthType Negotiate (CVSS 8.0)
• CVE-2024-35235 — Cupsd Listen arbitrary chmod 0140777 (CVSS 6.7)
• CVE-2023-4504 — OpenPrinting CUPS/libppd Postscript Parsing Heap Overflow (CVSS 7.0)
• CVE-2023-34241 — CUPS vulnerable to use-after-free in cupsdAcceptClient() (CVSS 7.1)
• CVE-2023-32324 — OpenPrinting CUPS vulnerable to heap buffer overflow (CVSS 5.5)
• CVE-2022-26691 — (CVSS 6.7)