OpenPrinting CUPS: Heap overflow in `get_options()`
Priority MEDIUM 63CWE-122Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · None · Low
- Fix status
- Partial Red Hat: 1 fixed, 6 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat.
Summary
OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.16 and prior, there is a heap-based buffer overflow in the CUPS scheduler when building filter option strings from job attribute. At time of publication, there are no publicly available patches.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00409 35th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial Red Hat: 1 advisoryRed Hat: 1 fixed, 6 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| OpenPrinting | cups | up to 2.4.16 | — | No fix listed | CNA |
- cups VendorOpenPrinting Affected up to 2.4.16 Fixed in — No fix listed CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:openprinting:cups:*:*:*:*:*:*:*:* | up to 2.4.16 | Vulnerable | OpenPrinting |
- cpe:2.3:a:openprinting:cups:*:*:*:*:*:*:*:* Versions up to 2.4.16 Vulnerable ·OpenPrinting
Remediation
Red Hat 1 advisory
- RHSA-2026:8814 Released 2026-04-17 · Red Hat rating ImportantRed Hat Hardened Images RPMs bug fix and enhancement update
- Red Hat Hardened Images cups-2.4.17-1.hum1@aarch64, cups-2.4.17-1.hum1@src, cups-2.4.17-1.hum1@x86_64 +14
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 10 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 6 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 7 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 8 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 9 | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift Container Platform 4 | Affected | No fix yet: Fix deferred |
| Red Hat Hardened Images | Fixed | RHSA-2026:8814 |
Timeline
- 2026-10-02 Threatist record created from CVE-2026-34979
References
More OpenPrinting Cups vulnerabilities
- TI-2025-35903 cups has Authentication bypass with AuthType Negotiate CVSS 3.1HIGH 8.0
- TI-2023-17077 CUPS vulnerable to use-after-free in cupsdAcceptClient() CVSS 3.1HIGH 7.1
- TI-2026-27200 Path traversal in OpenPrinting cups CVSS 3.1MEDIUM 6.5
- TI-2023-04157 OpenPrinting CUPS/libppd Postscript Parsing Heap Overflow CVSS 3.1HIGH 7.0
- TI-2026-74874 Path traversal in OpenPrinting CUPS banner handling discloses files CVSS 3.1MEDIUM 5.3
- TI-2025-38265 OpenPrinting CUPS vulnerable to stack based out-of-bound write CVSS 3.1MEDIUM 6.7
Sources
- CVE-2026-34979 · CVE Program
- CVE-2026-34979 · NVD
- FIRST EPSS
- CVE-2026-34979 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences