CVE-2026-41079
published 2026-04-24CVE-2026-41079: OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.17, a network-adjacent attacker can send a…
PriorityP426medium5.4CVSS 3.1
AVAACLPRNUINSUCLINAL
EPSS
0.41%
34.0th percentile
OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.17, a network-adjacent attacker can send a crafted SNMP response to the CUPS SNMP backend that causes an out-of-bounds read of up to 176 bytes past a stack buffer. The leaked memory is converted from UTF-16 to UTF-8 and stored as printer supply description strings, which are subsequently visible to authenticated users via IPP Get-Printer-Attributes responses and the CUPS web interface. This vulnerability is fixed in 2.4.17.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apple | cups | — | — |
| openprinting | cups | < 2.4.17 | 2.4.17 |
| ubuntu | cups | — | — |
CVSS provenance
nvdv3.15.4MEDIUMCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
vendor_ubuntu6.3MEDIUM
vendor_redhat4.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
OpenPrinting cups up to 2.4.16 on Linux Web Interface out-of-bounds (GHSA-6wpw-g8g6-wvrv)
vuldb·2026-04-24·CVSS 4.3
CVE-2026-41079 [MEDIUM] OpenPrinting cups up to 2.4.16 on Linux Web Interface out-of-bounds (GHSA-6wpw-g8g6-wvrv)
A vulnerability labeled as problematic has been found in OpenPrinting cups up to 2.4.16 on Linux. This affects an unknown function of the component Web Interface. Executing a manipulation can lead to out-of-bounds read.
This vulnerability appears as CVE-2026-41079. The attacker needs to be present on the local network. There is no available exploit.
The affected component should be upgraded.
Ubuntu
CUPS regression
vendor_ubuntu·2026-06-15·CVSS 6.3
CVE-2026-27447 [MEDIUM] CUPS regression
Title: CUPS regression
Summary: USN-8405-1 introduced a regression in CUPS
USN-8405-1 fixed vulnerabilities in CUPS. The update introduced a
regression that cause CUPS to crash when parsing certain large printer PPD
files. This update fixes the problem.
Original advisory details:
Ariel Silver discovered that CUPS incorrectly handled username comparisons
during authorization checks. A local attacker could possibly use this issue
to gain unauthorized access to restricted operations. (CVE-2026-27447)
Asim Viladi Oglu Manizada discovered that CUPS incorrectly handled
notify-recipient-uri values in the RSS notifier. A remote attacker could
possibly use this issue to overwrite lp-writable files and cause a denial
of service. (CVE-2026-34978)
Jacob Newman discovered that CUPS incorrectly ha
Ubuntu
CUPS vulnerabilities
vendor_ubuntu·2026-06-08·CVSS 6.3
CVE-2026-41079 [MEDIUM] CUPS vulnerabilities
Title: CUPS vulnerabilities
Summary: Several security issues were fixed in CUPS.
Ariel Silver discovered that CUPS incorrectly handled username comparisons
during authorization checks. A local attacker could possibly use this issue
to gain unauthorized access to restricted operations. (CVE-2026-27447)
Asim Viladi Oglu Manizada discovered that CUPS incorrectly handled
notify-recipient-uri values in the RSS notifier. A remote attacker could
possibly use this issue to overwrite lp-writable files and cause a denial
of service. (CVE-2026-34978)
Jacob Newman discovered that CUPS incorrectly handled filter option strings
when processing job attributes. An attacker could use this issue to cause
CUPS to crash, resulting in a denial of service, or possibly execute
arbitrary code. (CVE-2026-34979
Red Hat
cups: CUPS: Information disclosure via crafted SNMP response
vendor_redhat·2026-04-24·CVSS 4.3
CVE-2026-41079 [MEDIUM] CWE-125 cups: CUPS: Information disclosure via crafted SNMP response
cups: CUPS: Information disclosure via crafted SNMP response
A flaw was found in CUPS. A network-adjacent attacker can send a specially crafted Simple Network Management Protocol (SNMP) response to the CUPS SNMP backend, leading to an out-of-bounds read. This vulnerability allows for the disclosure of up to 176 bytes of sensitive memory, which is then converted and stored as printer supply description strings. Authenticated users can subsequently view this leaked information through IPP Get-Printer-Attributes responses and the CUPS web interface.
Statement: This is a Low impact information disclosure flaw in CUPS, where a network-adjacent attacker can trigger an out-of-bounds read in the SNMP backend. This vulnerability allows for the disclosure of up to 176 bytes of sensitive memory, wh
No detection rules found.
No public exploits indexed.
https://github.com/OpenPrinting/cups/commit/b7c2525a885f528d243c3a92197ca99609b3f080https://github.com/OpenPrinting/cups/commit/d7fe0f521ff3b24676511e747b058362b9a20737https://github.com/OpenPrinting/cups/security/advisories/GHSA-6wpw-g8g6-wvrvhttps://github.com/OpenPrinting/cups/security/advisories/GHSA-6wpw-g8g6-wvrv
2026-04-24
Published