TI-2026-74870 Aliases CVE-2026-55467

CUPS fax option values bypass control character sanitizer

MEDIUM 46CWE-150Published 2026-10-15 · Updated 2026-10-15

Key facts

Attack vector: Local
Privileges required: Low
User interaction: None
Attack complexity: High
Impact type: Code execution
Confidentiality · integrity · availability: None · None · Low
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-94.

Summary

OpenPrinting CUPS before 2.4.20 passes fax option values from a configured queue to filter options without the control-character sanitizing applied to other job attributes. A user permitted to submit a job can inject control characters into the downstream option stream (CWE-93). The reporter says a downstream fax filter could run code as lp, while the maintainer says the possible impact is disruption of the queue. A public exploit is linked in the references.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, the cupsdCreateJob option-string builder in scheduler/job.c maps attacker-controlled destination-uri and pre-dial-string values from a configured fax queue to the phone and faxPrefix options. Unlike ordinary IPP job attributes, these mapped fax values bypass the control-character sanitizer and are copied directly into the filter options argument. A user permitted to submit a job can therefore inject control characters into the downstream option stream. The reporter states that a downstream fax filter passing these values to a shell or modem command could execute code as lp, while the maintainer states that CUPS has no confidentiality or integrity impact because the only known code-executing filter is optional Foomatic and addressed separately, leaving possible disruption of the affected queue. This issue is fixed in version 2.4.20.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00182 7th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed cups (OpenPrinting): 2.4.20Red Hat: 1 advisory

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
OpenPrinting	cups	before 2.4.20	2.4.20	Patch available	CNA

cups VendorOpenPrinting Affected before 2.4.20 Fixed in 2.4.20 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:openprinting:cups::::::::	before 2.4.20	Vulnerable	OpenPrinting

cpe:2.3:a:openprinting:cups:*:*:*:*:*:*:*:* Versions before 2.4.20 Vulnerable ·OpenPrinting

Remediation

Upgrade OpenPrinting CUPS to version 2.4.20, which fixes this issue. Red Hat Hardened Images is fixed by RHSA-2026:84421, released 2026-10-17.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Fix · CNA cups (OpenPrinting) Fixed in 2.4.20

Red Hat 1 advisory

RHSA-2026:84421 Released 2026-10-17 · Red Hat rating Important
Red Hat Hardened Images RPMs Security Update
- Red Hat Hardened Images cups-2.4.19-4.6.hum1@aarch64, cups-2.4.19-4.6.hum1@s390x, cups-2.4.19-4.6.hum1@src +22

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat Hardened Images	Fixed	RHSA-2026:84421

Timeline

2026-10-16 Threatist record created from CVE-2026-55467
2026-10-16 Affected versions changed · Red Hat
2026-10-16 CVSS score added · Red Hat
2026-10-18 Fix available: RHSA-2026:84421 · Red Hat
2026-10-18 Fix available: Red Hat Hardened Images · Red Hat

References

Exploit 1

https://github.com/OpenPrinting/cups/security/advisories/GHSA-69qc-prxg-h2c7

Patch 2

Other 1

https://github.com/OpenPrinting/cups/releases/tag/v2.4.20

TI-2025-35903 cups has Authentication bypass with AuthType Negotiate CVSS 3.1HIGH 8.0
TI-2023-17077 CUPS vulnerable to use-after-free in cupsdAcceptClient() CVSS 3.1HIGH 7.1
TI-2026-27200 Path traversal in OpenPrinting cups CVSS 3.1MEDIUM 6.5
TI-2023-04157 OpenPrinting CUPS/libppd Postscript Parsing Heap Overflow CVSS 3.1HIGH 7.0
TI-2026-74874 Path traversal in OpenPrinting CUPS banner handling discloses files CVSS 3.1MEDIUM 5.3
TI-2026-27201 OpenPrinting CUPS: Heap overflow in `get_options()` CVSS 3.1MEDIUM 5.3

See all 24 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences