The cupsUTF32ToUTF8() function in cups/transcode.c lacks a source-length parameter and reads until encountering a zero word or exhausting output capacity. This vulnerability is reachable through SNMP supply-description parsing in backend/snmp-supplies.c using a 1025-byte fixed buffer with attacker-controlled content, resulting in heap out-of-bounds read.

The function reads 8-byte words on 64-bit platforms (where cups_utf32_t is unsigned long) without bounds checking on the source buffer, while the destination buffer constraint alone proves insufficient for preventing overread.

Affected versions: <= master (verified against 8a109df, 2026-07-31). No patched release listed at time of advisory.

Reference: https://github.com/OpenPrinting/cups/security/advisories/GHSA-559w-7676-3xrq