What’s Vulnerable › Vulnerabilities

CVE-2026-107890

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.1% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-10-09 · updated 2026-10-20
• Weakness: CWE-476

Description

OpenPrinting CUPS before 2.4.20 contains a NULL pointer dereference caused by repeated IPP group tags in job-creation requests. IPP parsing creates unnamed separator attributes with IPP_TAG_ZERO, but add_job() converts these separators to IPP_TAG_JOB. During job startup, get_options()/ipp_length() subsequently calls strlen() on a NULL attribute name, terminating cupsd and disrupting all queues. A single crafted Print-Job request can trigger the crash when the client can reach the scheduler and submit jobs to an accepting, enabled queue supporting the submitted document format. Anonymous submission is possible when permitted by listener and access-control configuration.

Affected products

• OpenPrinting cups: before 2.4.20 — fixed in 2.4.20

How to fix

Upgrade to a fixed version: OpenPrinting cups 2.4.20. Check the vendor advisory for mitigations.

References

• https://github.com/OpenPrinting/cups/security/advisories/GHSA-wjc4-qhjr-5m5x
• https://github.com/OpenPrinting/cups/security/advisories/GHSA-wjc4-qhjr-5m5x

Get alerted when CVE-2026-107890 or the next vulnerability affects your stack