CVE-2026-39316: CUPS has a use-after-free in `cupsdDeleteTemporaryPrinters` via dangling subscription pointer
CUPS has a use-after-free in cupsdDeleteTemporaryPrinters via dangling subscription pointer
Other sources
OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.16 and prior, a use-after-free vulnerability exists in the CUPS scheduler (cupsd) when temporary printers are automatically deleted. cupsdDeleteTemporaryPrinters() in scheduler/printers.c calls cupsdDeletePrinter() without first expiring subscriptions that reference the printer, leaving cupsdsubscriptiont.dest as a dangling pointer to freed heap memory. The dangling pointer is subsequently dereferenced at multiple code sites, causing a crash (denial of service) of the cupsd daemon. With heap grooming, this can be leveraged for code execution.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-39316?
CVE-2026-39316 is classified as a critical severity vulnerability due to its potential for exploitation.
How does CVE-2026-39316 affect CUPS?
CVE-2026-39316 affects CUPS versions 2.4.16 and earlier, leading to a use-after-free condition that can be exploited.
How do I fix CVE-2026-39316?
To fix CVE-2026-39316, upgrade to a version of CUPS newer than 2.4.16 that addresses this vulnerability.
What are the potential consequences of exploiting CVE-2026-39316?
Exploitation of CVE-2026-39316 could allow an attacker to execute arbitrary code or crash the CUPS scheduler.
Is my system vulnerable to CVE-2026-39316?
If you are running CUPS version 2.4.16 or earlier, your system is vulnerable to CVE-2026-39316.