CVE-2026-107888
published 2026-10-09CVE-2026-107888: OpenPrinting CUPS before 2.4.20 contains a NULL pointer dereference in cupsdCheckJobs() when a job marked job-held-on-create refers to a temporary printer that…
PriorityP421medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.09%
0.5th percentile
OpenPrinting CUPS before 2.4.20 contains a NULL pointer dereference in cupsdCheckJobs() when a job marked job-held-on-create refers to a temporary printer that has been automatically deleted. Temporary-printer cleanup can remove the destination without canceling its held jobs, and the scheduler dereferences the NULL result of cupsdFindDest() while checking holding_new_jobs. This terminates cupsd and interrupts all queues managed by that process. In some plausible scenarios, an unprivileged submission can trigger this.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apple | cups | — | — |
| openprinting | cups | < 2.4.20 | 2.4.20 |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vendor_redhat5.1MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
cups: CUPS: Denial of Service via deleted temporary printer
vendor_redhat·2026-10-09·CVSS 5.1
CVE-2026-107888 [MEDIUM] CWE-476 cups: CUPS: Denial of Service via deleted temporary printer
cups: CUPS: Denial of Service via deleted temporary printer
A flaw was found in CUPS. An attacker with access to the local print service can cause a Denial of Service (DoS) by submitting a held print job targeted at a temporary printer that is subsequently deleted. Because the print scheduler fails to verify that the printer destination still exists before checking the job status, it accesses invalid memory and crashes the cupsd daemon, interrupting all managed print queues.
Package: cups (Red Hat Enterprise Linux 10) - Fix deferred
Package: cups (Red Hat Enterprise Linux 6) - Out of support scope
Package: cups (Red Hat Enterprise Linux 7) - Fix deferred
Package: cups (Red Hat Enterprise Linux 8) - Fix deferred
Package: cups (Red Hat Enterprise Linux 9) - Fix deferred
Package: cups
GHSA
OpenPrinting CUPS before 2.4.20 contains a NULL pointer dereference in cupsdCheckJobs() when a job marked job-held-on-create refers to a temporary printer that has been automatically deleted.
ghsa_unreviewed·2026-10-09
CVE-2026-107888 [MEDIUM] CWE-476 OpenPrinting CUPS before 2.4.20 contains a NULL pointer dereference in cupsdCheckJobs() when a job marked job-held-on-create refers to a temporary printer that has been automatically deleted.
OpenPrinting CUPS before 2.4.20 contains a NULL pointer dereference in cupsdCheckJobs() when a job marked job-held-on-create refers to a temporary printer that has been automatically deleted. Temporary-printer cleanup can remove the destination without canceling its held jobs, and the scheduler dereferences the NULL result of cupsdFindDest() while checking holding_new_jobs. This terminates cupsd and interrupts all queues managed by that process. In some plausible scenarios, an unprivileged submission can trigger this.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-107888 cups: CUPS: Denial of Service via deleted temporary printer
bugzilla·2026-10-09·CVSS 5.1
CVE-2026-107888 [MEDIUM] CVE-2026-107888 cups: CUPS: Denial of Service via deleted temporary printer
CVE-2026-107888 cups: CUPS: Denial of Service via deleted temporary printer
OpenPrinting CUPS before 2.4.20 contains a NULL pointer dereference in cupsdCheckJobs() when a job marked job-held-on-create refers to a temporary printer that has been automatically deleted. Temporary-printer cleanup can remove the destination without canceling its held jobs, and the scheduler dereferences the NULL result of cupsdFindDest() while checking holding_new_jobs. This terminates cupsd and interrupts all queues managed by that process. In some plausible scenarios, an unprivileged submission can trigger this.
Bugzilla
CVE-2026-107888 cups: CUPS: Denial of Service via deleted temporary printer [fedora-all]
bugzilla·2026-10-09·CVSS 5.1
CVE-2026-107888 [MEDIUM] CVE-2026-107888 cups: CUPS: Denial of Service via deleted temporary printer [fedora-all]
CVE-2026-107888 cups: CUPS: Denial of Service via deleted temporary printer [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
OpenPrinting CUPS before 2.4.20 contains a NULL pointer dereference in cupsdCheckJobs() when a job marked job-held-on-create refers to a temporary printer that has been automatically deleted. Temporary-printer cleanup can remove the destination without canceling its held jobs, and the scheduler dereferences the NULL result of cupsdFindDest() while checking holding_new_jobs. This terminates cupsd and interrupts all queues managed by that process. In some plausible scenarios, an unp
2026-10-09
Published