CVE-2026-107886
published 2026-10-09CVE-2026-107886: OpenPrinting CUPS before 2.4.20 contains a double-free in printer-class management. When CUPS-Add-Modify-Class replaces an existing class member list…
PriorityP335medium6.5CVSS 3.1
AVNACLPRHUINSUCNIHAH
EPSS
0.20%
9.2th percentile
OpenPrinting CUPS before 2.4.20 contains a double-free in printer-class management. When CUPS-Add-Modify-Class replaces an existing class member list, add_class() frees pclass->printers without clearing the pointer. If subsequent validation fails, the class retains the dangling pointer; CUPS-Delete-Class subsequently frees the same allocation in cupsdDeletePrinter(). A client authorized to modify and delete classes can cause scheduler-wide denial of service. The default policy requires @SYSTEM privileges.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apple | cups | — | — |
| openprinting | cups | >= 1.4.8 < 2.4.20 | 2.4.20 |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
vendor_redhat2.3LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
cups: cups: Denial of Service via double-free in printer class management
vendor_redhat·2026-10-09·CVSS 2.3
CVE-2026-107886 [LOW] CWE-1341 cups: cups: Denial of Service via double-free in printer class management
cups: cups: Denial of Service via double-free in printer class management
A flaw was found in CUPS. An authenticated user authorized to manage printer classes can cause a Denial of Service (DoS) by triggering a double-free memory error during printer class management. By submitting a class modification request with invalid parameters followed by a class deletion request, the user can crash the print scheduler service.
Package: cups (Red Hat Enterprise Linux 10) - Fix deferred
Package: cups (Red Hat Enterprise Linux 6) - Not affected
Package: cups (Red Hat Enterprise Linux 7) - Fix deferred
Package: cups (Red Hat Enterprise Linux 8) - Fix deferred
Package: cups (Red Hat Enterprise Linux 9) - Fix deferred
Package: cups (Red Hat Hardened Images) - Affected
GHSA
OpenPrinting CUPS before 2.4.20 contains a double-free in printer-class management.
ghsa_unreviewed·2026-10-09
CVE-2026-107886 [LOW] CWE-415 OpenPrinting CUPS before 2.4.20 contains a double-free in printer-class management.
OpenPrinting CUPS before 2.4.20 contains a double-free in printer-class management. When CUPS-Add-Modify-Class replaces an existing class member list, add_class() frees pclass->printers without clearing the pointer. If subsequent validation fails, the class retains the dangling pointer; CUPS-Delete-Class subsequently frees the same allocation in cupsdDeletePrinter(). A client authorized to modify and delete classes can cause scheduler-wide denial of service. The default policy requires @SYSTEM privileges.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-107886 cups: cups: Denial of Service via double-free in printer class management [fedora-all]
bugzilla·2026-10-09·CVSS 2.3
CVE-2026-107886 [LOW] CVE-2026-107886 cups: cups: Denial of Service via double-free in printer class management [fedora-all]
CVE-2026-107886 cups: cups: Denial of Service via double-free in printer class management [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
OpenPrinting CUPS before 2.4.20 contains a double-free in printer-class management. When CUPS-Add-Modify-Class replaces an existing class member list, add_class() frees pclass->printers without clearing the pointer. If subsequent validation fails, the class retains the dangling pointer; CUPS-Delete-Class subsequently frees the same allocation in cupsdDeletePrinter(). A client authorized to modify and delete classes can cause scheduler-wide denial of service. The defa
Bugzilla
CVE-2026-107886 cups: cups: Denial of Service via double-free in printer class management
bugzilla·2026-10-09·CVSS 2.3
CVE-2026-107886 [LOW] CVE-2026-107886 cups: cups: Denial of Service via double-free in printer class management
CVE-2026-107886 cups: cups: Denial of Service via double-free in printer class management
OpenPrinting CUPS before 2.4.20 contains a double-free in printer-class management. When CUPS-Add-Modify-Class replaces an existing class member list, add_class() frees pclass->printers without clearing the pointer. If subsequent validation fails, the class retains the dangling pointer; CUPS-Delete-Class subsequently frees the same allocation in cupsdDeletePrinter(). A client authorized to modify and delete classes can cause scheduler-wide denial of service. The default policy requires @SYSTEM privileges.
2026-10-09
Published