CVE-2026-55480 in CUPS
Summary
by MITRE • 10/15/2026
OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, copy_model() in scheduler/ipp.c creates a predictable TempDir/<connection-number>.ppd path in an lp-group-writable directory and opens it as root without O_EXCL or O_NOFOLLOW. Exploitation requires an lp-group process able to write that directory to predict the connection-derived name and plant a symlink before the root open, while a privileged add-printer or modify-printer operation using a model PPD triggers copy_model(). The reporter treats an existing lp foothold and the privileged operation as distinct prerequisites, while the maintainer assesses high privileges because installing the relevant filter or administering the printer requires root or print-administrator access. If the race succeeds, the root scheduler follows the symlink and truncates or overwrites a root-writable target with generated PPD data, compromising file integrity or availability. This issue is fixed in version 2.4.20.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/15/2026
OpenPrinting CUPS serves as a foundational printing system for Linux and various Unix-like operating systems, managing print queues, drivers, and network sharing services. A critical vulnerability exists within the scheduler component of versions prior to 2.4.20, specifically in the copy_model function located in the source file scheduler/ipp.c. This flaw represents a classic race condition combined with insecure temporary file creation practices that can lead to privilege escalation or denial of service under specific conditions. The core technical issue stems from how the application handles temporary files during printer model operations. When an administrative action such as adding or modifying a printer is performed, the system invokes copy_model to process PostScript Printer Description (PPD) files. During this process, the function generates a predictable file path within a directory designated for temporary storage associated with specific connection numbers. Crucially, this directory is configured with permissions that allow members of the lp group to write to it, and the subsequent open operation lacks essential security flags such as O_EXCL or O_NOFOLLOW.
The absence of O_EXCL means the application does not fail if the target file already exists, allowing for overwrites rather than exclusive creation. The lack of O_NOFOLLOW permits symbolic link following during the open call. Because the filename is derived from predictable connection identifiers, an attacker with access to the lp group can anticipate the exact path that will be generated by a concurrent privileged operation. By monitoring or predicting these paths, an actor capable of writing to the lp-group-writable directory can plant a malicious symlink pointing to a sensitive root-owned file before the copy_model function executes its open call. When the scheduler runs with elevated privileges and attempts to write the PPD data, it follows the symlink due to the missing O_NOFOLLOW flag, thereby truncating or overwriting the target file specified by the attacker rather than creating the intended temporary file in a secure location.
The operational impact of this vulnerability is significant because it allows an unprivileged user with lp group membership to influence system behavior through a race condition that requires coordination with a privileged administrative action. While exploitation technically requires two distinct prerequisites—a foothold within the lp group and a concurrent privileged operation like adding or modifying a printer—the maintainer classifies the risk as high due to the potential for compromising file integrity and availability on systems where root-writable targets are accessible via symlinks planted in the temporary directory. This scenario aligns with CWE-377, which describes insecure temporary files that can be exploited through race conditions or predictable naming schemes. Furthermore, this vulnerability maps to ATT&CK technique T1564.002, known as File and Directory Permissions Modification, specifically within the context of privilege escalation via symlink attacks where an attacker manipulates file system objects to redirect privileged operations toward unintended targets.
Mitigation strategies primarily involve upgrading to CUPS version 2.4.20 or later, which addresses these flaws by implementing secure temporary file creation practices. Developers should ensure that all open calls for temporary files utilize O_EXCL to prevent overwriting existing files and O_NOFOLLOW to prevent following symbolic links, thereby neutralizing the symlink attack vector described in this vulnerability. Additionally, restricting write permissions on directories containing predictable temporary files or using mkstemp with secure directory paths can further harden the system against such race conditions. System administrators should also review group memberships for lp-related services and ensure that only trusted users have access to these groups, reducing the surface area for potential exploitation even if software updates are delayed.