CVE-2026-39316

OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.16 and prior, a use-after-free vulnerability exists in the CUPS scheduler (cupsd) when temporary printers are automatically deleted. cupsdDeleteTemporaryPrinters() in scheduler/printers.c calls cupsdDeletePrinter() without first expiring subscriptions that reference the printer, leaving cupsd_subscription_t.dest as a dangling pointer to freed heap memory. The dangling pointer is subsequently dereferenced at multiple code sites, causing a crash (denial of service) of the cupsd daemon. With heap grooming, this can be leveraged for code execution.

CVSS v3 4.0 MEDIUM

4.0^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.5 / Impact : 1.4

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://github.com/OpenPrinting/cups/security/advisories/GHSA-pjv5-prqp-46rg	Exploit Mitigation Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:openprinting:cups:*:*:*:*:*:*:*:*

History

26 Oct 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) OpenPrinting CUPS es un sistema de impresión de código abierto para Linux y otros sistemas operativos tipo Unix. En las versiones 2.4.16 y anteriores, existe una vulnerabilidad de uso después de liberación en el planificador de CUPS (cupsd) cuando las impresoras temporales se eliminan automáticamente. cupsdDeleteTemporaryPrinters() en scheduler/printers.c llama a cupsdDeletePrinter() sin antes expirar las suscripciones que hacen referencia a la impresora, dejando cupsd_subscription_t.dest como un puntero colgante a memoria de montón liberada. El puntero colgante es posteriormente desreferenciado en múltiples sitios de código, causando un fallo (denegación de servicio) del demonio cupsd. Con la preparación del montón, esto puede ser aprovechado para la ejecución de código.

Information

Published : 2026-04-07 17:16

Updated : 2026-10-26 22:10

NVD link : CVE-2026-39316

Mitre link : CVE-2026-39316

CVE.ORG link : CVE-2026-39316

JSON object : View

Products Affected

openprinting

cups

CWE

CWE-416

Use After Free

{"id": "CVE-2026-39316", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-39316", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-09T15:41:44.005836Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.0, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.5}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.2, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.5}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "OpenPrinting", "product": "cups", "versions": [{"status": "affected", "version": "<= 2.4.16"}]}]}], "published": "2026-04-07T17:16:37.230", "references": [{"url": "https://github.com/OpenPrinting/cups/security/advisories/GHSA-pjv5-prqp-46rg", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-416"}]}], "descriptions": [{"lang": "en", "value": "OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.16 and prior, a use-after-free vulnerability exists in the CUPS scheduler (cupsd) when temporary printers are automatically deleted. cupsdDeleteTemporaryPrinters() in scheduler/printers.c calls cupsdDeletePrinter() without first expiring subscriptions that reference the printer, leaving cupsd_subscription_t.dest as a dangling pointer to freed heap memory. The dangling pointer is subsequently dereferenced at multiple code sites, causing a crash (denial of service) of the cupsd daemon. With heap grooming, this can be leveraged for code execution."}, {"lang": "es", "value": "OpenPrinting CUPS es un sistema de impresi\u00f3n de c\u00f3digo abierto para Linux y otros sistemas operativos tipo Unix. En las versiones 2.4.16 y anteriores, existe una vulnerabilidad de uso despu\u00e9s de liberaci\u00f3n en el planificador de CUPS (cupsd) cuando las impresoras temporales se eliminan autom\u00e1ticamente. cupsdDeleteTemporaryPrinters() en scheduler/printers.c llama a cupsdDeletePrinter() sin antes expirar las suscripciones que hacen referencia a la impresora, dejando cupsd_subscription_t.dest como un puntero colgante a memoria de mont\u00f3n liberada. El puntero colgante es posteriormente desreferenciado en m\u00faltiples sitios de c\u00f3digo, causando un fallo (denegaci\u00f3n de servicio) del demonio cupsd. Con la preparaci\u00f3n del mont\u00f3n, esto puede ser aprovechado para la ejecuci\u00f3n de c\u00f3digo."}], "lastModified": "2026-10-26T22:10:00.163", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:openprinting:cups:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8A2A4507-B2D7-43B8-B008-6EC2F5053FA9", "versionEndIncluding": "2.4.16"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}