OpenPrinting CUPS before 2.4.20 contains a NULL pointer dereference caused by repeated IPP group tags in job-creation requests. IPP parsing creates unnamed separator attributes with IPP_TAG_ZERO, but add_job() converts these separators to IPP_TAG_JOB. During job startup, get_options()/ipp_length() subsequently calls strlen() on a NULL attribute name, terminating cupsd and disrupting all queues. A single crafted Print-Job request can trigger the crash when the client can reach the scheduler and submit jobs to an accepting, enabled queue supporting the submitted document format. Anonymous submission is possible when permitted by listener and access-control configuration.
Fix
Patch, vendor advisory and mitigation references on NVD 2
- https://github.com/OpenPrinting/cups/security/advisories/GHSA-wjc4-qhjr-5m5x Exploit, Patch, Vendor Advisory
- https://github.com/OpenPrinting/cups/security/advisories/GHSA-wjc4-qhjr-5m5x Exploit, Patch, Vendor Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 4
- Cpes+1 CPE criteria (now 1)NVD modified 2026-10-20 20:53
- StatusAwaiting Analysis → AnalyzedNVD modified 2026-10-20 20:53
- CVSS3.3 (v3.1, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) → 5.5 (v3.1, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)NVD modified 2026-10-20 20:53
- First seenCVSS 3.3NVD modified 2026-10-13 17:17
Affected (CPE criteria) 1
cpe:2.3:a:openprinting:cups:*:*:*:*:*:*:*:*
References 2
- https://github.com/OpenPrinting/cups/security/advisories/GHSA-wjc4-qhjr-5m5x Exploit, Patch, Vendor Advisory
- https://github.com/OpenPrinting/cups/security/advisories/GHSA-wjc4-qhjr-5m5x Exploit, Patch, Vendor Advisory