Red Hat Security Advisory

RHSA-2026:81410

Red Hat Hardened Images RPMs Security Update

Released 2026-10-12 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Hardened Images cups-2.4.19-4.5.hum1@aarch64, cups-2.4.19-4.5.hum1@s390x, cups-2.4.19-4.5.hum1@src +22

Fixes 4 records

TI-2026-69843 CVE-2026-107886

Double free in OpenPrinting CUPS printer-class management

MEDIUM 62

OpenPrinting CUPS before 2.4.20 contains a double-free in printer-class management.

CVSS 3.1MEDIUM 6.5 Network High privileges No interaction EPSS 0.00241 Published 2026-10-09 Partial fix · 2.4.20 CWE-415

TI-2026-69846 CVE-2026-107890

NULL pointer dereference in OpenPrinting CUPS scheduler via print jobs

MEDIUM 58

OpenPrinting CUPS before 2.4.20 contains a NULL pointer dereference caused by repeated IPP group tags in job-creation requests.

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00149 Published 2026-10-09 Partial fix · 2.4.20 CWE-476

TI-2026-69842 CVE-2026-107885

OpenPrinting CUPS resource exhaustion in job submission timeout handling

MEDIUM 58

OpenPrinting CUPS through 2.4.20 contains a resource-exhaustion vulnerability in the submission-timeout handling of cupsdCheckJobs().

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00147 Published 2026-10-09 Partial fix CWE-770

TI-2026-69844 CVE-2026-107888

NULL pointer dereference in CUPS lets job submissions crash cupsd

LOW 24

OpenPrinting CUPS before 2.4.20 contains a NULL pointer dereference in cupsdCheckJobs() when a job marked job-held-on-create refers to a temporary printer that has been automatically deleted.

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00133 Published 2026-10-09 Partial fix · 2.4.20 CWE-476