CVE-2026-95511 in Red Hat
Summary
by MITRE • 09/22/2026
A privilege escalation vulnerability was found in CUPS when used with the cups-filters serial backend. A local user who is a member of the lpadmin group can configure a printer that uses a privileged serial backend. The CUPS scheduler does not restrict the path component of non-file device URIs, so the root-privileged backend can write attacker-controlled print data to an arbitrary file. This can be used to change security-sensitive CUPS configuration and ultimately achieve root code execution. Exploitation requires local lpadmin group membership and a serial backend binary installed with root-only permissions.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/22/2026
The vulnerability identified in the Common Unix Printing System (CUPS) represents a critical privilege escalation flaw within the cups-filters package, specifically affecting the handling of serial device backends. This security issue stems from an insufficient validation mechanism regarding Uniform Resource Identifiers used to define printer devices. When CUPS processes print jobs for printers configured with non-file device URIs, such as those pointing to serial ports like /dev/ttyS0 or similar hardware interfaces, it fails to properly restrict the path components of these URIs. This lack of input sanitization allows a local user who possesses membership in the lpadmin group to manipulate how the CUPS scheduler interacts with privileged backend processes. The core technical flaw lies in the assumption that non-file URIs are inherently safe or strictly controlled by system administrators, leading the root-privileged backend process to accept and act upon attacker-controlled data without adequate verification of its destination or structure.
From an operational perspective, this vulnerability enables a local user with lpadmin privileges to execute arbitrary code as the root user. By configuring a printer that utilizes a privileged serial backend, an attacker can craft specific print job data designed to exploit the unrestricted path handling. Since the backend process runs with elevated permissions, it writes the maliciously crafted print data directly to file paths specified within the URI or derived from it. This capability allows the attacker to overwrite critical system files, including CUPS configuration files such as cupsd.conf or other sensitive system configurations located in directories accessible by the root user. The ability to modify these security-sensitive configuration files is particularly dangerous because it can alter authentication mechanisms, access controls, and logging settings, thereby weakening the overall security posture of the host system.
The exploitation chain culminates in full root code execution, granting the attacker complete control over the affected machine. This level of compromise allows for further lateral movement within a network, installation of persistent backdoors, exfiltration of sensitive data, or disruption of critical services. The vulnerability is classified under CWE-269, which addresses Improper Privilege Management, as it involves an actor gaining higher-level permissions than intended through misconfigured access controls and insufficient validation of input parameters. Additionally, this behavior aligns with ATT&CK technique T1078, Valid Accounts, where the attacker leverages legitimate administrative credentials or group memberships to escalate privileges and maintain persistence on the target system. The requirement for local lpadmin membership means that any user granted printer administration rights can potentially compromise the entire host if they are aware of this flaw and have access to a serial backend binary installed with root-only permissions.
Mitigation strategies must focus on both immediate remediation and long-term architectural improvements. Administrators should immediately apply vendor-provided patches or updates for CUPS and cups-filters that address this specific input validation issue. In environments where patching is not instantly feasible, restricting lpadmin group membership to only those users who strictly require it can reduce the attack surface. Furthermore, implementing strict file system permissions on directories containing critical configuration files can prevent unauthorized writes even if an attacker manages to exploit the URI parsing flaw. It is also advisable to audit all configured printers for any that use serial backends and ensure they are necessary; removing unnecessary backend configurations reduces potential vectors for exploitation. Regular monitoring of CUPS logs for unusual printer configurations or unexpected file modifications in system directories can aid in early detection of attempted exploits. Ultimately, adhering to the principle of least privilege by minimizing administrative group memberships is the most effective defense against this class of vulnerability.