Bug 2454954 (CVE-2026-34980) - CVE-2026-34980 cups: OpenPrinting CUPS: Shared PostScript queue lets anonymous Print-Job requests reach `lp` code execution over the network
Summary: CVE-2026-34980 cups: OpenPrinting CUPS: Shared PostScript queue lets anonymou...
Keywords:
Status: NEW
Alias: CVE-2026-34980
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On: 2454991
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-04-03 22:01 UTC by OSIDB Bzimport
Modified: 2026-05-19 16:22 UTC (History)
3 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:


Attachments (Terms of Use)

Description OSIDB Bzimport 2026-04-03 22:01:42 UTC
OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.16 and prior, in a network-exposed cupsd with a shared target queue, an unauthorized client can send a Print-Job to that shared PostScript queue without authentication. The server accepts a page-border value supplied as textWithoutLanguage, preserves an embedded newline through option escaping and reparse, and then reparses the resulting second-line PPD: text as a trusted scheduler control record. A follow-up raw print job can therefore make the server execute an attacker-chosen existing binary such as /usr/bin/vim as lp. At time of publication, there are no publicly available patches.


Note You need to log in before you can comment on or make changes to this bug.