OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, the backend/ipp.c quote_string() function preserves carriage-return and line-feed characters in a remote printer-controlled marker-message before report_attr() writes the value to the scheduler status stream. The scheduler can parse an injected newline as a separate PPD: control line and persist an attacker-selected PPD keyword. The reporter demonstrated that a later print job on a Foomatic-backed queue could consume an injected FoomaticRIPCommandLine value and execute in the filter context as lp. This issue is fixed in version 2.4.20.
Fix
Patch, vendor advisory and mitigation references on NVD 3
- https://github.com/OpenPrinting/cups/commit/806e1b483096c51d59432468f4afdd7387d81dd7 Patch
- https://github.com/OpenPrinting/cups/commit/d41cf0616688721e9d435d54118c4c8a36ed596a Patch
- https://github.com/OpenPrinting/cups/security/advisories/GHSA-7hqf-mfhx-7r3v Exploit, Patch, Vendor Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 4
- Cpes+1 CPE criteria (now 1)NVD modified 2026-10-20 19:38
- StatusAwaiting Analysis → AnalyzedNVD modified 2026-10-20 19:38
- StatusReceived → Awaiting AnalysisNVD modified 2026-10-16 16:00
- First seenCVSS 3.3NVD modified 2026-10-15 18:17
Affected (CPE criteria) 1
cpe:2.3:a:openprinting:cups:*:*:*:*:*:*:*:*
References 4
- https://github.com/OpenPrinting/cups/commit/806e1b483096c51d59432468f4afdd7387d81dd7 Patch
- https://github.com/OpenPrinting/cups/commit/d41cf0616688721e9d435d54118c4c8a36ed596a Patch
- https://github.com/OpenPrinting/cups/releases/tag/v2.4.20 Release Notes
- https://github.com/OpenPrinting/cups/security/advisories/GHSA-7hqf-mfhx-7r3v Exploit, Patch, Vendor Advisory