CVE-2026-41079

Root has patched CVE-2026-41079 in the cups package for Root:Debian:12. Multiple fixed versions available.

Root has patched CVE-2026-41079 in the cups package for Root:Debian:13. Multiple fixed versions available.

OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.17, a network-adjacent attacker can send a crafted SNMP response to the CUPS SNMP backend that causes an out-of-bounds read of up to 176 bytes past a stack buffer. The leaked memory is converted from UTF-16 to UTF-8 and stored as printer supply description strings, which are subsequently visible to authenticated users via IPP Get-Printer-Attributes responses and the CUPS web interface. This vulnerability is fixed in 2.4.17.

OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.17, a network-adjacent attacker can send a crafted SNMP response to the CUPS SNMP backend that causes an out-of-bounds read of up to 176 bytes past a stack buffer. The leaked memory is converted from UTF-16 to UTF-8 and stored as printer supply description strings, which are subsequently visible to authenticated users via IPP Get-Printer-Attributes responses and the CUPS web interface. This vulnerability is fixed in 2.4.17.

• CVE-2026-41079: limit num_bytes for SNMP string values to prevent out-of-bounds read in asn1_decode_snmp

• CVE-2026-41079: limit num_bytes for SNMP string values to prevent out-of-bounds read in asn1_decode_snmp

These are all security issues fixed in the cups-2.4.19-2.1 package on the GA media of openSUSE Tumbleweed.

This update for cups fixes the following issues

• CVE-2026-27447: Authorization bypass via case-insensitive group-member lookup (bsc#1261572).
• CVE-2026-34978: Path traversal in RSS notify-recipient-uri enables file write outside CacheDir/rss (bsc#1261571).
• CVE-2026-34979: Heap overflow in get_options() (bsc#1261570).
• CVE-2026-34980: Shared PostScript queue lets anonymous Print-Job requests reach lp code execution over the network (bsc#1261569).
• CVE-2026-34990: Local print admin token disclosure using temporary printers (bsc#1261568).
• CVE-2026-39314: negative job-password-supported attribute can lead to a denial of service (bsc#1261743).
• CVE-2026-39316: dangling subscription pointer can lead to a denial of service (bsc#1261742).
• CVE-2026-41079: crafted SNMP response can lead to stack-based out-of-bounds read and sensitive memory disclosure (bsc#1263116).

Changes for cups:

• Version upgrade to 2.4.19.

• Version upgrade to 2.4.18.

• Version upgrade to 2.4.17:

• The scheduler followed symbolic links when cleaning out its temporary directory (Issue #1448)
• Updated cupsFileGetConf and cupsFilePutConf to escape more characters.
• Updated man page cancel (Issue #984)
• Updated cupsRasterReadHeader to validate more of the page header values (Issue #1501)
• Fixed an issue with the class/printer CGI name checking.
• Fixed infinite loop in http_write() on busy print servers (Issue #827)
• Fixed potential TLS blocking issues (Issue #1128)
• Fixed a job history bug in the scheduler (Issue #1440)
• Fixed notifier logging bug that would result in nul bytes getting into the log (Issue #1450)
• Fixed possible use-after-free in cupsdReadClient() (Issue #1454)
• Fixed a document format bug in the IPP backend (Issue #1457)
• Fixed DRAIN_OUTPUT race condition (Issue #1461)
• Fixed a bug when then ippFindXxx and ippSetXxx functions were mixed.
• Fixed the mapping of supply type keywords to SNMP names.
• Fixed a bug in the IPP backend when SNMP was disabled.
• Fixed a crash bug in the rastertoepson filter.
• Fixed a bug in cgiCheckVariables.
• Fixed handling read/write errors with OpenSSL (Issue #1506)
• Fixed handling rehandshake error in _httpTLSRead (Issue #1508)
• Fixed a debug printf bug on Windows (Issue #1529)
• Fixed a recursion issue with encoding of nested collections (Issue #1539)
• Fixed parsing of the LimitRequestBody, MaxLogSize, and MaxRequestSize directives in "cupsd.conf" (Issue #1540)
• Fixed a parsing bug in ipptool (Issue #1542)
• Fixed blank line detection in the rastertolabel filter (Issue #1545)
• Fixed httpPeek edge case on compressed streams

This update for cups fixes the following issues

• CVE-2026-27447: Authorization bypass via case-insensitive group-member lookup (bsc#1261572).
• CVE-2026-34978: Path traversal in RSS notify-recipient-uri enables file write outside CacheDir/rss (bsc#1261571).
• CVE-2026-34979: Heap overflow in get_options() (bsc#1261570).
• CVE-2026-34980: Shared PostScript queue lets anonymous Print-Job requests reach lp code execution over the network (bsc#1261569).
• CVE-2026-34990: Local print admin token disclosure using temporary printers (bsc#1261568).
• CVE-2026-39314: negative job-password-supported attribute can lead to a denial of service (bsc#1261743).
• CVE-2026-39316: dangling subscription pointer can lead to a denial of service (bsc#1261742).
• CVE-2026-41079: crafted SNMP response can lead to stack-based out-of-bounds read and sensitive memory disclosure (bsc#1263116).

Changes for cups:

• Version upgrade to 2.4.19

This update for cups fixes the following issues

• CVE-2026-27447: Authorization bypass via case-insensitive group-member lookup (bsc#1261572).
• CVE-2026-34978: Path traversal in RSS notify-recipient-uri enables file write outside CacheDir/rss (bsc#1261571).
• CVE-2026-34979: Heap overflow in get_options() (bsc#1261570).
• CVE-2026-34980: Shared PostScript queue lets anonymous Print-Job requests reach lp code execution over the network (bsc#1261569).
• CVE-2026-34990: Local print admin token disclosure using temporary printers (bsc#1261568).
• CVE-2026-39314: negative job-password-supported attribute can lead to a denial of service (bsc#1261743).
• CVE-2026-39316: dangling subscription pointer can lead to a denial of service (bsc#1261742).
• CVE-2026-41079: crafted SNMP response can lead to stack-based out-of-bounds read and sensitive memory disclosure (bsc#1263116).

Changes for cups:

• Version upgrade to 2.4.19.

• Version upgrade to 2.4.18.

• Version upgrade to 2.4.17:

• The scheduler followed symbolic links when cleaning out its temporary directory (Issue #1448)
• Updated cupsFileGetConf and cupsFilePutConf to escape more characters.
• Updated man page cancel (Issue #984)
• Updated cupsRasterReadHeader to validate more of the page header values (Issue #1501)
• Fixed an issue with the class/printer CGI name checking.
• Fixed infinite loop in http_write() on busy print servers (Issue #827)
• Fixed potential TLS blocking issues (Issue #1128)
• Fixed a job history bug in the scheduler (Issue #1440)
• Fixed notifier logging bug that would result in nul bytes getting into the log (Issue #1450)
• Fixed possible use-after-free in cupsdReadClient() (Issue #1454)
• Fixed a document format bug in the IPP backend (Issue #1457)
• Fixed DRAIN_OUTPUT race condition (Issue #1461)
• Fixed a bug when then ippFindXxx and ippSetXxx functions were mixed.
• Fixed the mapping of supply type keywords to SNMP names.
• Fixed a bug in the IPP backend when SNMP was disabled.
• Fixed a crash bug in the rastertoepson filter.
• Fixed a bug in cgiCheckVariables.
• Fixed handling read/write errors with OpenSSL (Issue #1506)
• Fixed handling rehandshake error in _httpTLSRead (Issue #1508)
• Fixed a debug printf bug on Windows (Issue #1529)
• Fixed a recursion issue with encoding of nested collections (Issue #1539)
• Fixed parsing of the LimitRequestBody, MaxLogSize, and MaxRequestSize directives in "cupsd.conf" (Issue #1540)
• Fixed a parsing bug in ipptool (Issue #1542)
• Fixed blank line detection in the rastertolabel filter (Issue #1545)
• Fixed httpPeek edge case on compressed streams

This update for cups fixes the following issues

• CVE-2026-27447: Authorization bypass via case-insensitive group-member lookup (bsc#1261572).
• CVE-2026-34978: Path traversal in RSS notify-recipient-uri enables file write outside CacheDir/rss (bsc#1261571).
• CVE-2026-34979: Heap overflow in get_options() (bsc#1261570).
• CVE-2026-34980: Shared PostScript queue lets anonymous Print-Job requests reach lp code execution over the network (bsc#1261569).
• CVE-2026-34990: Local print admin token disclosure using temporary printers (bsc#1261568).
• CVE-2026-39314: negative job-password-supported attribute can lead to a denial of service (bsc#1261743).
• CVE-2026-39316: dangling subscription pointer can lead to a denial of service (bsc#1261742).
• CVE-2026-41079: crafted SNMP response can lead to stack-based out-of-bounds read and sensitive memory disclosure (bsc#1263116).

Changes for cups:

• Version upgrade to 2.4.19.

• Version upgrade to 2.4.18.

• Version upgrade to 2.4.17:

• The scheduler followed symbolic links when cleaning out its temporary directory (Issue #1448)
• Updated cupsFileGetConf and cupsFilePutConf to escape more characters.
• Updated man page cancel (Issue #984)
• Updated cupsRasterReadHeader to validate more of the page header values (Issue #1501)
• Fixed an issue with the class/printer CGI name checking.
• Fixed infinite loop in http_write() on busy print servers (Issue #827)
• Fixed potential TLS blocking issues (Issue #1128)
• Fixed a job history bug in the scheduler (Issue #1440)
• Fixed notifier logging bug that would result in nul bytes getting into the log (Issue #1450)
• Fixed possible use-after-free in cupsdReadClient() (Issue #1454)
• Fixed a document format bug in the IPP backend (Issue #1457)
• Fixed DRAIN_OUTPUT race condition (Issue #1461)
• Fixed a bug when then ippFindXxx and ippSetXxx functions were mixed.
• Fixed the mapping of supply type keywords to SNMP names.
• Fixed a bug in the IPP backend when SNMP was disabled.
• Fixed a crash bug in the rastertoepson filter.
• Fixed a bug in cgiCheckVariables.
• Fixed handling read/write errors with OpenSSL (Issue #1506)
• Fixed handling rehandshake error in _httpTLSRead (Issue #1508)
• Fixed a debug printf bug on Windows (Issue #1529)
• Fixed a recursion issue with encoding of nested collections (Issue #1539)
• Fixed parsing of the LimitRequestBody, MaxLogSize, and MaxRequestSize directives in "cupsd.conf" (Issue #1540)
• Fixed a parsing bug in ipptool (Issue #1542)
• Fixed blank line detection in the rastertolabel filter (Issue #1545)
• Fixed httpPeek edge case on compressed streams

This update for cups fixes the following issues

• CVE-2026-27447: Authorization bypass via case-insensitive group-member lookup (bsc#1261572).
• CVE-2026-34978: Path traversal in RSS notify-recipient-uri enables file write outside CacheDir/rss (bsc#1261571).
• CVE-2026-34979: Heap overflow in get_options() (bsc#1261570).
• CVE-2026-34980: Shared PostScript queue lets anonymous Print-Job requests reach lp code execution over the network (bsc#1261569).
• CVE-2026-34990: Local print admin token disclosure using temporary printers (bsc#1261568).
• CVE-2026-39314: negative job-password-supported attribute can lead to a denial of service (bsc#1261743).
• CVE-2026-39316: dangling subscription pointer can lead to a denial of service (bsc#1261742).
• CVE-2026-41079: crafted SNMP response can lead to stack-based out-of-bounds read and sensitive memory disclosure (bsc#1263116).

Changes for cups:

• Version upgrade to 2.4.19

This update for cups fixes the following issue:

• CVE-2026-41079: crafted SNMP response can lead to stack-based out-of-bounds read and sensitive memory disclosure (bsc#1263116).

This update for cups fixes the following issues:

• CVE-2026-41079: crafted SNMP response can lead to stack-based out-of-bounds read and sensitive memory disclosure (bsc#1263116).
• CVE-2026-105326: argument injection in mailto notifier allows unauthenticated remote code execution (bsc#1284274).

Ariel Silver discovered that CUPS incorrectly handled username comparisons during authorization checks. A local attacker could possibly use this issue to gain unauthorized access to restricted operations. (CVE-2026-27447)

Asim Viladi Oglu Manizada discovered that CUPS incorrectly handled notify-recipient-uri values in the RSS notifier. A remote attacker could possibly use this issue to overwrite lp-writable files and cause a denial of service. (CVE-2026-34978)

Jacob Newman discovered that CUPS incorrectly handled filter option strings when processing job attributes. An attacker could use this issue to cause CUPS to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2026-34979)

Asim Viladi Oglu Manizada discovered that CUPS incorrectly handled page-border values in shared PostScript queues. A remote attacker could possibly use this issue to execute arbitrary code. (CVE-2026-34980)

Asim Viladi Oglu Manizada discovered that CUPS incorrectly handled localhost authentication to attacker-controlled IPP services. A local attacker could possibly use this issue to overwrite arbitrary files and execute arbitrary code. (CVE-2026-34990)

Tomer Fichman discovered that CUPS incorrectly handled negative job-password-supported values. A local attacker could possibly use this issue to cause CUPS to crash, resulting in a denial of service. (CVE-2026-39314)

Tomer Fichman discovered that CUPS incorrectly handled temporary printer deletion. An attacker could possibly use this issue to cause CUPS to crash, resulting in a denial of service, or to execute arbitrary code. (CVE-2026-39316)

Tomer Fichman discovered that CUPS incorrectly handled certain malformed SNMP responses. An attacker could possibly use this issue to obtain sensitive information. (CVE-2026-41079)