CVE-2026-39314: CUPS has an integer underflow in `_ppdCreateFromIPP` causes root cupsd crash via negative `job-password-supported`
CUPS has an integer underflow in ppdCreateFromIPP causes root cupsd crash via negative job-password-supported
Other sources
OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.16 and prior, an integer underflow vulnerability in ppdCreateFromIPP() (cups/ppd-cache.c) allows any unprivileged local user to crash the cupsd root process by supplying a negative job-password-supported IPP attribute. The bounds check only caps the upper bound, so a negative value passes validation, is cast to sizet (wrapping to ~2^64), and is used as the length argument to memset() on a 33-byte stack buffer. This causes an immediate SIGSEGV in the cupsd root process. Combined with systemd's Restart=on-failure, an attacker can repeat the crash for sustained denial of service.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/cupsto a version that resolves this vulnerability.Fixed in 2.4.18-1 - Compensating control
If you cannot immediately upgrade, mitigate sustained DoS by preventing automatic restarts: inspect the cupsd systemd service unit and remove or change the Restart=on-failure behavior so the service does not continuously restart after a crash. Additionally, restrict local unprivileged user access to CUPS interfaces/sockets (limit access to management interfaces and filesystem sockets) to reduce the ability of local users to repeatedly trigger the crash.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-39314?
CVE-2026-39314 is considered a critical vulnerability due to its potential to crash the root cupsd service.
How do I fix CVE-2026-39314?
To fix CVE-2026-39314, users should update OpenPrinting CUPS to version 2.4.17 or later.
What versions of CUPS are affected by CVE-2026-39314?
CVE-2026-39314 affects OpenPrinting CUPS versions 2.4.16 and prior.
What kind of vulnerability is CVE-2026-39314?
CVE-2026-39314 is an integer underflow vulnerability in the `_ppdCreateFromIPP` function.
What can happen if CVE-2026-39314 is exploited?
If exploited, CVE-2026-39314 can lead to a root cupsd crash, potentially causing disruption in the printing service.