CVE-2026-107890 in CUPS
Summary
by MITRE • 10/09/2026
OpenPrinting CUPS before 2.4.20 contains a NULL pointer dereference caused by repeated IPP group tags in job-creation requests. IPP parsing creates unnamed separator attributes with IPP_TAG_ZERO, but add_job() converts these separators to IPP_TAG_JOB. During job startup, get_options()/ipp_length() subsequently calls strlen() on a NULL attribute name, terminating cupsd and disrupting all queues. A single crafted Print-Job request can trigger the crash when the client can reach the scheduler and submit jobs to an accepting, enabled queue supporting the submitted document format. Anonymous submission is possible when permitted by listener and access-control configuration.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/09/2026
The vulnerability identified in OpenPrinting CUPS versions prior to 2.4.20 represents a critical denial of service condition stemming from improper input validation within the Internet Printing Protocol parser. The core technical flaw resides in how the application handles IPP group tags during job creation requests. Specifically, when processing incoming print jobs, the IPP parsing logic generates unnamed separator attributes assigned with an IPP_TAG_ZERO value. However, subsequent internal functions responsible for adding these jobs to the system queue incorrectly convert these separators into IPP_TAG_JOB types without properly initializing or validating associated attribute names. This logical error creates a state where critical data structures contain null pointers that are expected to hold valid string references but instead remain uninitialized due to the malformed input sequence.
The operational impact of this flaw is immediate and severe, resulting in the termination of the cupsd daemon process. When the job startup routine executes, it invokes functions such as get_options() and ipp_length(), which attempt to calculate the length of attribute names using strlen(). Because these function calls operate on NULL pointers rather than valid memory addresses containing strings, a segmentation fault occurs. This crash causes the entire CUPS service to stop responding effectively disrupting all print queues managed by the system. The availability impact is total for any client relying on that specific server instance, as the daemon must be manually restarted before printing services can resume normal operation.
From a threat modeling perspective, this vulnerability aligns with CWE-476, which describes NULL Pointer Dereference vulnerabilities where software fails to check for null pointers before using them. Furthermore, it maps directly to MITRE ATT&CK technique T1499, Endpoint Denial of Service, specifically under the sub-category of Resource Exhaustion: Crash/Stop due to improper input handling. The attack vector is network-based and requires only a single crafted Print-Job request containing repeated IPP group tags that trigger the parsing error. An attacker does not need elevated privileges or complex exploitation chains; they merely need the ability to send packets to the CUPS scheduler on its listening port, typically TCP 631.
The exploitability of this vulnerability is contingent upon the server's access control configuration. If anonymous submission is permitted by the listener and access-control settings, any unauthenticated user on the network can trigger the crash remotely. Even if authentication is required, an attacker with valid credentials for a queue that accepts jobs in supported document formats can execute the denial of service attack. This makes it particularly dangerous in environments where print services are exposed to internal networks or public internet interfaces without strict filtering rules regarding IPP request structures.
Mitigation strategies must focus on both immediate remediation and long-term architectural hardening. The primary defense is upgrading CUPS to version 2.4.20 or later, which includes patches that properly validate attribute names before dereferencing them in the job creation workflow. Organizations should also review their IPP listener configurations to disable anonymous submission if not strictly required for business operations. Implementing network-level access control lists to restrict who can send Print-Job requests to port 631 adds a layer of defense-in-depth, limiting exposure to trusted internal subnets only. Additionally, deploying intrusion detection systems capable of identifying anomalous IPP packet structures with repeated group tags can help detect and block attempted exploitation before it reaches the vulnerable application logic.