CVE-2026-107888 in CUPS
Summary
by MITRE • 10/09/2026
OpenPrinting CUPS before 2.4.20 contains a NULL pointer dereference in cupsdCheckJobs() when a job marked job-held-on-create refers to a temporary printer that has been automatically deleted. Temporary-printer cleanup can remove the destination without canceling its held jobs, and the scheduler dereferences the NULL result of cupsdFindDest() while checking holding_new_jobs. This terminates cupsd and interrupts all queues managed by that process. In some plausible scenarios, an unprivileged submission can trigger this.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/09/2026
The Common UNIX Printing System (CUPS), a widely deployed printing service for Unix-like operating systems, contains a critical NULL pointer dereference vulnerability in versions prior to 2.4.20. This flaw resides within the cupsdCheckJobs() function and is triggered by a specific race condition involving temporary printers and held print jobs. The root cause lies in the lifecycle management of temporary printing destinations. When CUPS automatically deletes a temporary printer, it fails to properly cancel or reassign any associated print jobs that were marked as job-held-on-create. This oversight leaves the scheduler with references to non-existent destinations, creating an inconsistent state within the internal data structures.
When the cupsdCheckJobs() routine iterates through pending and held jobs to evaluate their status, it attempts to locate the destination printer for each job using the cupsdFindDest() function. In scenarios where a temporary printer has been removed but its associated held job remains in the queue, this lookup returns NULL because the target destination no longer exists in memory. The vulnerability arises because the code subsequently dereferences this NULL pointer without performing an adequate null check before proceeding with further operations related to holding_new_jobs. This invalid memory access causes the CUPS daemon process to crash immediately and ungracefully terminate.
The operational impact of this vulnerability is significant due to its potential for denial of service against printing infrastructure. Since a single instance of cupsd typically manages multiple print queues, the termination of the main scheduler process results in an immediate halt of all queued jobs across every printer managed by that daemon. This disruption affects not only local users but also networked clients relying on CUPS services for document processing and output generation. The severity is compounded by the fact that this condition can be triggered by unprivileged users who submit print jobs with specific holding attributes, making it a remotely exploitable or locally triggerable denial of service vector without requiring administrative privileges.
From a classification perspective, this vulnerability aligns with CWE-476, which denotes NULL Pointer Dereference, as the core issue is the unsafe access to memory via an uninitialized or null reference. In terms of attack vectors and tactics, it relates to ATT&CK technique T1529, System Shutdown/Reboot, specifically under the sub-context of service disruption through application crashes. While not a direct system reboot command, the forced termination of critical services achieves a similar effect of denying availability to legitimate users.
Mitigation strategies primarily involve upgrading CUPS to version 2.4.20 or later, where this logic error has been corrected by implementing proper null checks before dereferencing destination pointers and ensuring that temporary printer cleanup routines properly handle associated job states. Until an upgrade is feasible, administrators should monitor for unexpected daemon restarts which may indicate exploitation attempts. Additionally, restricting the ability to create temporary printers via unprivileged accounts can reduce the attack surface, although this may conflict with standard workflow requirements in many enterprise environments. Regular patching of printing subsystem components remains essential given their central role in organizational IT infrastructure and their frequent exposure to network-based job submission interfaces.