A flaw was found in CUPS when processing embedded job ticket comments in PostScript or PDF documents. The read_job_ticket() function in scheduler/ipp.c allows a job-ticket option named attributes-natural-language to replace the valid IPP operation attribute with a keyword attribute, because the replacement lookup does not restrict the attribute group. When the job starts, cupsdContinueJob() in scheduler/job.c looks up the attribute as IPP_TAG_LANGUAGE and dereferences the NULL result without checking it. An unauthenticated client permitted to submit jobs to an accepting shared printer queue can send a single crafted IPP Print-Job request to crash cupsd before any document filter or backend starts, temporarily interrupting printing for all users. The upstream report reproduced the crash on CUPS 2.4.19, 2.4.20, and the 2.4.x development branch. Loopback-only deployments are not remotely reachable through this path. The ticket states that the service automatically restarts after failure; no confidentiality or integrity impact is demonstrated. Validation associated with CVE-2026-61702 does not prevent this issue because job-ticket processing modifies the attribute after that validation. Upstream fixes restrict job-ticket attributes and disable job-ticket comment processing by default in the 2.4.x branch, and remove this functionality in the branch for 2.5 and later.