Read the docs
TI-2026-27202 Aliases CVE-2026-34980

OpenPrinting CUPS: Shared PostScript queue lets anonymous Print-Job requests reach `lp` code execution over the network

Priority MEDIUM 60CWE-20Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
High · Low · Low
Fix status
Partial Red Hat: 7 fixed, 2 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat.

Summary

OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.16 and prior, in a network-exposed cupsd with a shared target queue, an unauthorized client can send a Print-Job to that shared PostScript queue without authentication. The server accepts a page-border value supplied as textWithoutLanguage, preserves an embedded newline through option escaping and reparse, and then reparses the resulting second-line PPD: text as a trusted scheduler control record. A follow-up raw print job can therefore make the server execute an attacker-chosen existing binary such as /usr/bin/vim as lp. At time of publication, there are no publicly available patches.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.01652 76th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial Red Hat: 4 advisoriesRed Hat: 7 fixed, 2 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
OpenPrintingcupsup to 2.4.16—No fix listedCNA
  • cups VendorOpenPrinting Affected up to 2.4.16 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:openprinting:cups:*:*:*:*:*:*:*:*up to 2.4.16VulnerableOpenPrinting
  • cpe:2.3:a:openprinting:cups:*:*:*:*:*:*:*:* Versions up to 2.4.16 Vulnerable ·OpenPrinting

Remediation

Red Hat 4 advisories

  • RHSA-2026:39316 Released 2026-07-14 · Red Hat rating Moderate
    cups security update
    • Red Hat Enterprise Linux AppStream (v. 9) cups-1:2.3.3op2-39.el9_8
    • Red Hat Enterprise Linux BaseOS (v. 9) cups-1:2.3.3op2-39.el9_8
  • RHSA-2026:39302 Released 2026-07-14 · Red Hat rating Moderate
    cups security update
    • Red Hat Enterprise Linux AppStream (v. 10) cups-1:2.4.10-18.el10_2
    • Red Hat Enterprise Linux BaseOS (v. 10) cups-1:2.4.10-18.el10_2
  • RHSA-2026:36733 Released 2026-07-08 · Red Hat rating Moderate
    cups security update
    • Red Hat Enterprise Linux AppStream (v. 8) cups-1:2.2.6-68.el8_10
    • Red Hat Enterprise Linux BaseOS (v. 8) cups-1:2.2.6-68.el8_10
Show 1 more Red Hat advisories
  • RHSA-2026:8814 Released 2026-04-17 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images cups-2.4.17-1.hum1@aarch64, cups-2.4.17-1.hum1@src, cups-2.4.17-1.hum1@x86_64 +14

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 6AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 7AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux AppStream (v. 10)Fixed RHSA-2026:39302
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2026:36733
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2026:39316
Red Hat Enterprise Linux BaseOS (v. 10)Fixed RHSA-2026:39302
Red Hat Enterprise Linux BaseOS (v. 8)Fixed RHSA-2026:36733
Red Hat Enterprise Linux BaseOS (v. 9)Fixed RHSA-2026:39316
Red Hat Hardened ImagesFixed RHSA-2026:8814
Not affected: 7 products
  • Red Hat Enterprise Linux AppStream (v. 10)
  • Red Hat Enterprise Linux AppStream (v. 8)
  • Red Hat Enterprise Linux AppStream (v. 9)
  • Red Hat Enterprise Linux BaseOS (v. 10)
  • Red Hat Enterprise Linux BaseOS (v. 8)
  • Red Hat Enterprise Linux BaseOS (v. 9)
  • Red Hat OpenShift Container Platform 4

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-34980
  2. 2026-10-25 EPSS moved to the 50th–90th percentile

References

Exploit 1

  • TI-2025-35903 cups has Authentication bypass with AuthType Negotiate CVSS 3.1HIGH 8.0
  • TI-2023-17077 CUPS vulnerable to use-after-free in cupsdAcceptClient() CVSS 3.1HIGH 7.1
  • TI-2026-27200 Path traversal in OpenPrinting cups CVSS 3.1MEDIUM 6.5
  • TI-2023-04157 OpenPrinting CUPS/libppd Postscript Parsing Heap Overflow CVSS 3.1HIGH 7.0
  • TI-2026-74874 Path traversal in OpenPrinting CUPS banner handling discloses files CVSS 3.1MEDIUM 5.3
  • TI-2026-27201 OpenPrinting CUPS: Heap overflow in `get_options()` CVSS 3.1MEDIUM 5.3
See all 24 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences