CVE-2026-107890

OpenPrinting CUPS before 2.4.20 contains a NULL pointer dereference caused by repeated IPP group tags in job-creation requests. IPP parsing creates unnamed separator attributes with IPP_TAG_ZERO, but add_job() converts these separators to IPP_TAG_JOB. During job startup, get_options()/ipp_length() subsequently calls strlen() on a NULL attribute name, terminating cupsd and disrupting all queues. A single crafted Print-Job request can trigger the crash when the client can reach the scheduler and submit jobs to an accepting, enabled queue supporting the submitted document format. Anonymous submission is possible when permitted by listener and access-control configuration.

CVSS v3 3.3 LOW

3.3^/10

CVSS v3 : LOW

Vector :

Exploitability : 1.8 / Impact : 1.4

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://github.com/OpenPrinting/cups/security/advisories/GHSA-wjc4-qhjr-5m5x	Exploit Patch Vendor Advisory
https://github.com/OpenPrinting/cups/security/advisories/GHSA-wjc4-qhjr-5m5x	Exploit Patch Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:openprinting:cups:*:*:*:*:*:*:*:*

History

20 Oct 2026, 20:53

Type	Values Removed	Values Added
CPE		cpe:2.3:a:openprinting:cups::::::::
First Time		Openprinting cups Openprinting
References	~~() https://github.com/OpenPrinting/cups/security/advisories/GHSA-wjc4-qhjr-5m5x -~~	() https://github.com/OpenPrinting/cups/security/advisories/GHSA-wjc4-qhjr-5m5x - Exploit, Patch, Vendor Advisory

13 Oct 2026, 17:17

Type	Values Removed	Values Added
References	~~() https://github.com/OpenPrinting/cups/security/advisories/GHSA-wjc4-qhjr-5m5x -~~	() https://github.com/OpenPrinting/cups/security/advisories/GHSA-wjc4-qhjr-5m5x -

09 Oct 2026, 05:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-10-09 05:16

Updated : 2026-10-20 20:53

NVD link : CVE-2026-107890

Mitre link : CVE-2026-107890

CVE.ORG link : CVE-2026-107890

JSON object : View

Products Affected

openprinting

cups

CWE

CWE-476

NULL Pointer Dereference

{"id": "CVE-2026-107890", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-107890", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-13T16:32:49.452913Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "cve@mitre.org", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.3, "attackVector": "LOCAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 1.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.8}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"repo": "https://github.com/OpenPrinting/cups", "vendor": "OpenPrinting", "product": "CUPS", "versions": [{"status": "affected", "version": "0", "lessThan": "2.4.20", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2026-10-09T05:16:44.730", "references": [{"url": "https://github.com/OpenPrinting/cups/security/advisories/GHSA-wjc4-qhjr-5m5x", "tags": ["Exploit", "Patch", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://github.com/OpenPrinting/cups/security/advisories/GHSA-wjc4-qhjr-5m5x", "tags": ["Exploit", "Patch", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "cve@mitre.org", "description": [{"lang": "en", "value": "CWE-476"}]}], "descriptions": [{"lang": "en", "value": "OpenPrinting CUPS before 2.4.20 contains a NULL pointer dereference caused by repeated IPP group tags in job-creation requests. IPP parsing creates unnamed separator attributes with IPP_TAG_ZERO, but add_job() converts these separators to IPP_TAG_JOB. During job startup, get_options()/ipp_length() subsequently calls strlen() on a NULL attribute name, terminating cupsd and disrupting all queues. A single crafted Print-Job request can trigger the crash when the client can reach the scheduler and submit jobs to an accepting, enabled queue supporting the submitted document format. Anonymous submission is possible when permitted by listener and access-control configuration."}], "lastModified": "2026-10-20T20:53:19.570", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:openprinting:cups:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2DB4F8BB-D97C-48D4-9B6F-F18BF8CC6E83", "versionEndExcluding": "2.4.20"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}