Bug 2530994 (CVE-2026-87875)

Summary: CVE-2026-87875 cups: OpenPrinting CUPS: Heap out-of-bounds read in cupsUTF32ToUTF8() via missing source-length bound
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: akhatavk, aos-team-art-private, asdas, dpaolell, jdelft, jupierce, lgarciaa, mbiarnes, ppalepu, ppostler, prdhamdh, rhel-process-autobot, sghai, sidsharm, suppawar, vlaad, watson-tool-maintainers, zdohnal
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
The cupsUTF32ToUTF8() function in CUPS's cups/transcode.c lacks a source-length bound and can read past the end of the source buffer, resulting in a heap out-of-bounds read. This is reachable via SNMP supply-description parsing in backend/snmp-supplies.c with attacker-controlled content.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-09-09 14:38:16 UTC 
The cupsUTF32ToUTF8() function in cups/transcode.c lacks a source-length parameter and reads until encountering a zero word or exhausting output capacity. This vulnerability is reachable through SNMP supply-description parsing in backend/snmp-supplies.c using a 1025-byte fixed buffer with attacker-controlled content, resulting in heap out-of-bounds read.

The function reads 8-byte words on 64-bit platforms (where cups_utf32_t is unsigned long) without bounds checking on the source buffer, while the destination buffer constraint alone proves insufficient for preventing overread.

Affected versions: <= master (verified against 8a109df, 2026-07-31). No patched release listed at time of advisory.

Reference: https://github.com/OpenPrinting/cups/security/advisories/GHSA-559w-7676-3xrq