TI-2026-74869 Aliases CVE-2026-55453

CUPS ipp backend injection can alter queue PPD settings

LOW 15CWE-74Published 2026-10-15 · Updated 2026-10-16

Key facts

Attack vector: Local
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: None · None · Low
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-77.

Summary

OpenPrinting CUPS before 2.4.20 is affected. The ipp backend does not strip carriage-return and line-feed characters from printer marker messages, so an injected newline is parsed as a separate PPD control line (CWE-77). A malicious printer can supply this data, and a later print job on a Foomatic-backed queue can then run commands as lp. The reporter demonstrated the attack, and an exploit is linked in the references.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, the backend/ipp.c quote_string() function preserves carriage-return and line-feed characters in a remote printer-controlled marker-message before report_attr() writes the value to the scheduler status stream. The scheduler can parse an injected newline as a separate PPD: control line and persist an attacker-selected PPD keyword. The reporter demonstrated that a later print job on a Foomatic-backed queue could consume an injected FoomaticRIPCommandLine value and execute in the filter context as lp. This issue is fixed in version 2.4.20.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00195 9th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed cups (OpenPrinting): 2.4.20Red Hat: 1 advisory

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
OpenPrinting	cups	before 2.4.20	2.4.20	Patch available	CNA

cups VendorOpenPrinting Affected before 2.4.20 Fixed in 2.4.20 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:openprinting:cups::::::::	before 2.4.20	Vulnerable	OpenPrinting

cpe:2.3:a:openprinting:cups:*:*:*:*:*:*:*:* Versions before 2.4.20 Vulnerable ·OpenPrinting

Remediation

Upgrade OpenPrinting CUPS to version 2.4.20. Red Hat advisory RHSA-2026:84421 covers Red Hat Hardened Images.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Fix · CNA cups (OpenPrinting) Fixed in 2.4.20

Red Hat 1 advisory

RHSA-2026:84421 Released 2026-10-17 · Red Hat rating Important
Red Hat Hardened Images RPMs Security Update
- Red Hat Hardened Images cups-2.4.19-4.6.hum1@aarch64, cups-2.4.19-4.6.hum1@s390x, cups-2.4.19-4.6.hum1@src +22

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat Hardened Images	Fixed	RHSA-2026:84421

Timeline

2026-10-16 Threatist record created from CVE-2026-55453
2026-10-16 Affected versions changed · Red Hat
2026-10-16 CVSS score added · Red Hat
2026-10-16 CISA SSVC decision points changed
2026-10-18 Fix available: RHSA-2026:84421 · Red Hat
2026-10-18 Fix available: Red Hat Hardened Images · Red Hat

References

Exploit 1

https://github.com/OpenPrinting/cups/security/advisories/GHSA-7hqf-mfhx-7r3v

Patch 2

Other 1

https://github.com/OpenPrinting/cups/releases/tag/v2.4.20

TI-2025-35903 cups has Authentication bypass with AuthType Negotiate CVSS 3.1HIGH 8.0
TI-2023-17077 CUPS vulnerable to use-after-free in cupsdAcceptClient() CVSS 3.1HIGH 7.1
TI-2026-27200 Path traversal in OpenPrinting cups CVSS 3.1MEDIUM 6.5
TI-2023-04157 OpenPrinting CUPS/libppd Postscript Parsing Heap Overflow CVSS 3.1HIGH 7.0
TI-2026-74874 Path traversal in OpenPrinting CUPS banner handling discloses files CVSS 3.1MEDIUM 5.3
TI-2026-27201 OpenPrinting CUPS: Heap overflow in `get_options()` CVSS 3.1MEDIUM 5.3

See all 24 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences