PaperCut Print Deploy up to 1.10.4177 on Windows pc-printer-updater.exe uncontrolled search path

Summaryinfo

A vulnerability was found in PaperCut Print Deploy up to 1.10.4177 on Windows. It has been rated as problematic. Affected by this issue is some unknown functionality of the file pc-printer-updater.exe. The manipulation leads to uncontrolled search path. This vulnerability is traded as CVE-2026-6645. An attack has to be approached locally. There is no exploit available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability was found in PaperCut Print Deploy up to 1.10.4177 on Windows and classified as critical. This issue affects an unknown function of the file pc-printer-updater.exe. The manipulation with an unknown input leads to a uncontrolled search path vulnerability. Using CWE to declare the problem leads to CWE-427. The product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

An insecure process execution vulnerability exists in the pc-printer-updater.exe component of the PaperCut Print Deploy Client for Windows. The application, which typically operates with high-level system privileges, attempts to perform an internal validation check by invoking a secondary system utility using an unqualified file reference. Because the application does not specify an absolute path to this utility, it relies on the operating system's default search order to locate the executable. Under specific conditions, a local attacker with the ability to modify directories within the system's search path could plant a malicious binary that mimics the expected utility. This could result in the malicious code being executed with SYSTEM privileges, leading to a full compromise of the affected host.

It is possible to read the advisory at papercut.com. The identification of this vulnerability is CVE-2026-6645 since 04/20/2026. The exploitation is known to be difficult. Attacking locally is a requirement. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1574 according to MITRE ATT&CK.

Upgrading to version 1.10.4178 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-38209). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• PaperCut

Name

• Print Deploy

Version

• 1.10.4177

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion