OpenPrinting CUPS/libppd Postscript Parsing Heap Overflow
Priority HIGH 66CWE-122Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- High
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 4 without a fix
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and Red Hat. Impact type from CWE-122 and the CVSS impact.
Summary
Due to failure in validating the length provided by an attacker-crafted PPD PostScript document, CUPS and libppd are susceptible to a heap-based buffer overflow and possibly code execution. This issue has been fixed in CUPS version 2.4.7, released in September of 2023.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00637 50th percentileScored 2026-11-07
Public exploit Yes 3 exploit referencesTagged by NVD
Fix Partial CUPS (OpenPrinting): 2.4.6Red Hat: 4 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| OpenPrinting | CUPS | before 2.4.6 | 2.4.6 | Patch available | CNA |
- CUPS VendorOpenPrinting Affected before 2.4.6 Fixed in 2.4.6 Patch available CNA
CPE configurations NVD · 6
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:openprinting:cups:*:*:*:*:*:*:*:* | before 2.4.7 | Vulnerable | OpenPrinting |
| cpe:2.3:a:openprinting:libppd:2.0:rc2:*:*:*:linux:*:* | 2.0 rc2 | Vulnerable | OpenPrinting |
| cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:* | 37 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:* | 38 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:* | 39 | Vulnerable | Fedoraproject |
| cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* | 10.0 | Vulnerable | Debian |
- cpe:2.3:a:openprinting:cups:*:*:*:*:*:*:*:* Versions before 2.4.7 Vulnerable ·OpenPrinting
- cpe:2.3:a:openprinting:libppd:2.0:rc2:*:*:*:linux:*:* Versions 2.0 rc2 Vulnerable ·OpenPrinting
- cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:* Versions 37 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:* Versions 38 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:* Versions 39 Vulnerable ·Fedoraproject
- cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian
Remediation
- Fix · CNA CUPS (OpenPrinting) Fixed in 2.4.6
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 6 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 7 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 8 | Affected | No fix planned: Will not fix |
| Red Hat Enterprise Linux 9 | Affected | No fix planned: Will not fix |
Timeline
- 2026-10-02 Threatist record created from CVE-2023-4504
- 2026-10-23 EPSS moved to the below the 50th percentile
- 2026-10-25 EPSS moved to the 50th–90th percentile
References
Exploit 3
Advisory 2
Other 5
- https://github.com/OpenPrinting/cups/releases/tag/v2.4.7
- https://lists.fedoraproject.org/archives/list/[email protected]/message/AMYDKIE4PSJDEMC5OWNFCDMHFGLJ57XG/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/5WVS4I7JG3LISFPKTM6ADKJXXEPEEWBQ/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/5WHEJIYMMAIXU2EC35MGTB5LGGO2FFJE/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/T2GSPQAFK2Z6L57TRXEKZDF42K2EVBH7/
More OpenPrinting Cups vulnerabilities
- TI-2025-35903 cups has Authentication bypass with AuthType Negotiate CVSS 3.1HIGH 8.0
- TI-2023-17077 CUPS vulnerable to use-after-free in cupsdAcceptClient() CVSS 3.1HIGH 7.1
- TI-2026-27200 Path traversal in OpenPrinting cups CVSS 3.1MEDIUM 6.5
- TI-2026-74874 Path traversal in OpenPrinting CUPS banner handling discloses files CVSS 3.1MEDIUM 5.3
- TI-2026-27201 OpenPrinting CUPS: Heap overflow in `get_options()` CVSS 3.1MEDIUM 5.3
- TI-2025-38265 OpenPrinting CUPS vulnerable to stack based out-of-bound write CVSS 3.1MEDIUM 6.7
Sources
- CVE-2023-4504 · CVE Program
- CVE-2023-4504 · NVD
- FIRST EPSS
- CVE-2023-4504 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences