CVE-2026-41079

OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.17, a network-adjacent attacker can send a crafted SNMP response to the CUPS SNMP backend that causes an out-of-bounds read of up to 176 bytes past a stack buffer. The leaked memory is converted from UTF-16 to UTF-8 and stored as printer supply description strings, which are subsequently visible to authenticated users via IPP Get-Printer-Attributes responses and the CUPS web interface. This vulnerability is fixed in 2.4.17.

CVSS v3 4.3 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector ADJACENT_NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/OpenPrinting/cups/commit/b7c2525a885f528d243c3a92197ca99609b3f080	Patch
https://github.com/OpenPrinting/cups/commit/d7fe0f521ff3b24676511e747b058362b9a20737	Patch
https://github.com/OpenPrinting/cups/security/advisories/GHSA-6wpw-g8g6-wvrv	Exploit Mitigation Patch Vendor Advisory
https://github.com/OpenPrinting/cups/security/advisories/GHSA-6wpw-g8g6-wvrv	Exploit Mitigation Patch Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:openprinting:cups:*:*:*:*:*:*:*:*

History

26 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) OpenPrinting CUPS es un sistema de impresión de código abierto para Linux y otros sistemas operativos tipo Unix. Previo a 2.4.17, un atacante adyacente a la red puede enviar una respuesta SNMP manipulada al backend SNMP de CUPS que causa una lectura fuera de límites de hasta 176 bytes más allá de un búfer de pila. La memoria filtrada se convierte de UTF-16 a UTF-8 y se almacena como cadenas de descripción de suministros de impresora, las cuales son posteriormente visibles para usuarios autenticados a través de respuestas IPP Get-Printer-Attributes y la interfaz web de CUPS. Esta vulnerabilidad está corregida en 2.4.17.

Information

Published : 2026-04-24 17:16

Updated : 2026-10-26 21:10

NVD link : CVE-2026-41079

Mitre link : CVE-2026-41079

CVE.ORG link : CVE-2026-41079

JSON object : View

Products Affected

openprinting

cups

CWE

CWE-125

Out-of-bounds Read

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

{"id": "CVE-2026-41079", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-41079", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-25T01:47:25.659814Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "OpenPrinting", "product": "cups", "versions": [{"status": "affected", "version": "< 2.4.17"}]}]}], "published": "2026-04-24T17:16:21.340", "references": [{"url": "https://github.com/OpenPrinting/cups/commit/b7c2525a885f528d243c3a92197ca99609b3f080", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/OpenPrinting/cups/commit/d7fe0f521ff3b24676511e747b058362b9a20737", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/OpenPrinting/cups/security/advisories/GHSA-6wpw-g8g6-wvrv", "tags": ["Exploit", "Mitigation", "Patch", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/OpenPrinting/cups/security/advisories/GHSA-6wpw-g8g6-wvrv", "tags": ["Exploit", "Mitigation", "Patch", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-125"}, {"lang": "en", "value": "CWE-200"}]}], "descriptions": [{"lang": "en", "value": "OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.17, a network-adjacent attacker can send a crafted SNMP response to the CUPS SNMP backend that causes an out-of-bounds read of up to 176 bytes past a stack buffer. The leaked memory is converted from UTF-16 to UTF-8 and stored as printer supply description strings, which are subsequently visible to authenticated users via IPP Get-Printer-Attributes responses and the CUPS web interface. This vulnerability is fixed in 2.4.17."}, {"lang": "es", "value": "OpenPrinting CUPS es un sistema de impresi\u00f3n de c\u00f3digo abierto para Linux y otros sistemas operativos tipo Unix. Previo a 2.4.17, un atacante adyacente a la red puede enviar una respuesta SNMP manipulada al backend SNMP de CUPS que causa una lectura fuera de l\u00edmites de hasta 176 bytes m\u00e1s all\u00e1 de un b\u00fafer de pila. La memoria filtrada se convierte de UTF-16 a UTF-8 y se almacena como cadenas de descripci\u00f3n de suministros de impresora, las cuales son posteriormente visibles para usuarios autenticados a trav\u00e9s de respuestas IPP Get-Printer-Attributes y la interfaz web de CUPS. Esta vulnerabilidad est\u00e1 corregida en 2.4.17."}], "lastModified": "2026-10-26T21:10:00.170", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:openprinting:cups:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7CC76E8F-8DC0-4A44-A6EB-2C2C6CF289AC", "versionEndExcluding": "2.4.17"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}