Every CVE Search/ Get API key

CVE-2026-55480

CUPS copy_model() creates a predictable PPD tempfile without O_EXCL/O_NOFOLLOW (symlink TOCTOU, lp → root)

5.7 MediumFix available

OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, copy_model() in scheduler/ipp.c creates a predictable TempDir/<connection-number>.ppd path in an lp-group-writable directory and opens it as root without O_EXCL or O_NOFOLLOW. Exploitation requires an lp-group process able to write that directory to predict the connection-derived name and plant a symlink before the root open, while a privileged add-printer or modify-printer operation using a model PPD triggers copy_model(). The reporter treats an existing lp foothold and the privileged operation as distinct prerequisites, while the maintainer assesses high privileges because installing the relevant filter or administering the printer requires root or print-administrator access. If the race succeeds, the root scheduler follows the symlink and truncates or overwrites a root-writable target with generated PPD data, compromising file integrity or availability. This issue is fixed in version 2.4.20.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
High
Privileges needed
High
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
High
Availability
High

Exploit likelihood

0.20%Unchanged since Oct 16, 2026
90%50%10%1%

What each source reports

CVE List Score used 5.7

CUPS copy_model() creates a predictable PPD tempfile without O_EXCL/O_NOFOLLOW (symlink TOCTOU, lp → root)

OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, copy_model() in scheduler/ipp.c creates a predictable TempDir/<connection-number>.ppd path in an lp-group-writable directory and opens it as root without O_EXCL or O_NOFOLLOW. Exploitation requires an lp-group process able to write that directory to predict the connection-derived name and plant a symlink before the root open, while a privileged add-printer or modify-printer operation using a model PPD triggers copy_model(). The reporter treats an existing lp foothold and the privileged operation as distinct prerequisites, while the maintainer assesses high privileges because installing the relevant filter or administering the printer requires root or print-administrator access. If the race succeeds, the root scheduler follows the symlink and truncates or overwrites a root-writable target with generated PPD data, compromising file integrity or availability. This issue is fixed in version 2.4.20.

Record
CVE-2026-55480
CVSS 3.1
5.7 MediumCVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:H
Weakness
CWE-59, CWE-377
Updated
2026-11-02
EUVDEUVD-2026-102205 5.7

OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, copy_model() in scheduler/ipp.c creates a predictable TempDir/<connection-number>.ppd path in an lp-group-writable directory and opens it as root without O_EXCL or O_NOFOLLOW. Exploitation requires an lp-group process able to write that directory to predict the connection-derived name and plant a symlink before the root open, while a privileged add-printer or modify-printer operation using a model PPD triggers copy_model(). The reporter treats an existing lp foothold and the privileged operation as distinct prerequisites, while the maintainer assesses high privileges because installing the relevant filter or administering the printer requires root or print-administrator access. If the race succeeds, the root scheduler follows the symlink and truncates or overwrites a root-writable target with generated PPD data, compromising file integrity or availability. This issue is fixed in version 2.4.20.

Record
EUVD-2026-102205
CVSS 3.1
5.7 MediumCVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:H
Updated
2026-11-02
NVD 5.7

OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, copy_model() in scheduler/ipp.c creates a predictable TempDir/<connection-number>.ppd path in an lp-group-writable directory and opens it as root without O_EXCL or O_NOFOLLOW. Exploitation requires an lp-group process able to write that directory to predict the connection-derived name and plant a symlink before the root open, while a privileged add-printer or modify-printer operation using a model PPD triggers copy_model(). The reporter treats an existing lp foothold and the privileged operation as distinct prerequisites, while the maintainer assesses high privileges because installing the relevant filter or administering the printer requires root or print-administrator access. If the race succeeds, the root scheduler follows the symlink and truncates or overwrites a root-writable target with generated PPD data, compromising file integrity or availability. This issue is fixed in version 2.4.20.

Record
CVE-2026-55480
CVSS 3.1
5.7 MediumCVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:H
Weakness
CWE-59, CWE-377
Updated
2026-11-02
OSVBELL-CVE-2026-55480 5.7
Record
BELL-CVE-2026-55480
CVSS 3.1
5.7 MediumCVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:H
Updated
2026-11-02
OSV 5.7

CUPS copy_model() creates a predictable PPD tempfile without O_EXCL/O_NOFOLLOW (symlink TOCTOU, lp → root)

OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, copy_model() in scheduler/ipp.c creates a predictable TempDir/<connection-number>.ppd path in an lp-group-writable directory and opens it as root without O_EXCL or O_NOFOLLOW. Exploitation requires an lp-group process able to write that directory to predict the connection-derived name and plant a symlink before the root open, while a privileged add-printer or modify-printer operation using a model PPD triggers copy_model(). The reporter treats an existing lp foothold and the privileged operation as distinct prerequisites, while the maintainer assesses high privileges because installing the relevant filter or administering the printer requires root or print-administrator access. If the race succeeds, the root scheduler follows the symlink and truncates or overwrites a root-writable target with generated PPD data, compromising file integrity or availability. This issue is fixed in version 2.4.20.

Record
CVE-2026-55480
CVSS 3.1
5.7 MediumCVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:H
Weakness
CWE-377, CWE-59
Updated
2026-11-02
OSVDEBIAN-CVE-2026-55480 5.7

OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, copy_model() in scheduler/ipp.c creates a predictable TempDir/<connection-number>.ppd path in an lp-group-writable directory and opens it as root without O_EXCL or O_NOFOLLOW. Exploitation requires an lp-group process able to write that directory to predict the connection-derived name and plant a symlink before the root open, while a privileged add-printer or modify-printer operation using a model PPD triggers copy_model(). The reporter treats an existing lp foothold and the privileged operation as distinct prerequisites, while the maintainer assesses high privileges because installing the relevant filter or administering the printer requires root or print-administrator access. If the race succeeds, the root scheduler follows the symlink and truncates or overwrites a root-writable target with generated PPD data, compromising file integrity or availability. This issue is fixed in version 2.4.20.

Record
DEBIAN-CVE-2026-55480
CVSS 3.1
5.7 MediumCVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:H
Updated
2026-11-02
Show 5 moreShow less
OSVRHSA-2026:84421 7.5

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Record
RHSA-2026:84421
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-55480 5.7

OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, copy_model() in scheduler/ipp.c creates a predictable TempDir/<connection-number>.ppd path in an lp-group-writable directory and opens it as root without O_EXCL or O_NOFOLLOW. Exploitation requires an lp-group process able to write that directory to predict the connection-derived name and plant a symlink before the root open, while a privileged add-printer or modify-printer operation using a model PPD triggers copy_model(). The reporter treats an existing lp foothold and the privileged operation as distinct prerequisites, while the maintainer assesses high privileges because installing the relevant filter or administering the printer requires root or print-administrator access. If the race succeeds, the root scheduler follows the symlink and truncates or overwrites a root-writable target with generated PPD data, compromising file integrity or availability. This issue is fixed in version 2.4.20.

Record
UBUNTU-CVE-2026-55480
CVSS 3.1
5.7 MediumCVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:H
Updated
2026-11-02
OSVAZL-108284 No score

CVE-2026-55480 affecting package cups 2.4.19-2

OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, copy_model() in scheduler/ipp.c creates a predictable TempDir/<connection-number>.ppd path in an lp-group-writable directory and opens it as root without O_EXCL or O_NOFOLLOW. Exploitation requires an lp-group process able to write that directory to predict the connection-derived name and plant a symlink before the root open, while a privileged add-printer or modify-printer operation using a model PPD triggers copy_model(). The reporter treats an existing lp foothold and the privileged operation as distinct prerequisites, while the maintainer assesses high privileges because installing the relevant filter or administering the printer requires root or print-administrator access. If the race succeeds, the root scheduler follows the symlink and truncates or overwrites a root-writable target with generated PPD data, compromising file integrity or availability. This issue is fixed in version 2.4.20.

Record
AZL-108284
Updated
2026-11-05
OSVMGASA-2026-0483 No score

Updated cups package fixes security vulnerabilities

CUPS ipp backend status-line injection can update queue PPD and lead to conditional RCE as lp via foomatic-rip. (CVE-2026-55453) CUPS fax option values bypass the CVE-2026-34980 control-character sanitizer (incomplete fix). (CVE-2026-55467) copy_model() creates a predictable PPD tempfile without O_EXCL/O_NOFOLLOW. (CVE-2026-55480) root-side banner file disclosure. (CVE-2026-61702) Heap out-of-bounds read in cupsUTF32ToUTF8() via missing source-length bound — reachable from SNMP supply-description parsing (backend/snmp-supplies.c). (CVE-2026-87875) CVE-2026-27447 follow-up: remaining case-insensitive username matching in scheduler side paths. (CVE-2026-87876) Argument injection in mailto notifier allows unauthenticated remote code execution. (CVE-2026-105326)

Record
MGASA-2026-0483
Updated
2026-11-02
OSVopenSUSE-SU-2026:12192-1 No score

cups-2.4.20-1.1 on GA media

These are all security issues fixed in the cups-2.4.20-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:12192-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
cups
Azure Linux:3
 through 2.4.19-2 None known
cups
Alpaquita:23
 2.4.2-r2 up to 2.4.20-r0
2.4.20-r0
cups
Alpaquita:25
 2.4.11-r1 up to 2.4.20-r0
2.4.20-r0
cups
Alpaquita:stream
 2.4.2-r5 up to 2.4.20-r0
2.4.20-r0
cups
Debian:12
 All versions, plus listed versions
2.4.10-12.4.10-22.4.10-32.4.10-42.4.14-1
Show 23 moreShow less
2.4.15-12.4.16-12.4.17-12.4.18-12.4.2-32.4.2-3+deb12u12.4.2-3+deb12u22.4.2-3+deb12u32.4.2-3+deb12u42.4.2-3+deb12u52.4.2-3+deb12u62.4.2-3+deb12u72.4.2-3+deb12u82.4.2-3+deb12u92.4.2-42.4.2-52.4.2-62.4.20-12.4.7-12.4.7-1.12.4.7-1.22.4.7-22.4.7-3
 None known
cups
Debian:13
 All versions, plus listed versions
2.4.10-32.4.10-3+deb13u12.4.10-3+deb13u22.4.10-42.4.14-1
Show 5 moreShow less
2.4.15-12.4.16-12.4.17-12.4.18-12.4.20-1
 None known
cups
Debian:14
 All versions, plus listed versions
2.4.10-32.4.10-42.4.14-12.4.15-12.4.16-12.4.17-12.4.18-12.4.20-1
 None known
cups
Mageia:10
From an advisory covering 7 CVEs
 before 2.4.20-1.mga10
2.4.20-1.mga10
cups
Red Hat:hummingbird:1
From an advisory covering 4 CVEs
 before 0:2.4.19-4.6.hum1
0:2.4.19-4.6.hum1
cups-client
Red Hat:hummingbird:1
From an advisory covering 4 CVEs
 before 0:2.4.19-4.6.hum1
0:2.4.19-4.6.hum1
Show 14 moreShow less
Affected packages
PackageAffectedFixed
cups-devel
Red Hat:hummingbird:1
From an advisory covering 4 CVEs
 before 0:2.4.19-4.6.hum1
0:2.4.19-4.6.hum1
cups-filesystem
Red Hat:hummingbird:1
From an advisory covering 4 CVEs
 before 0:2.4.19-4.6.hum1
0:2.4.19-4.6.hum1
cups-ipptool
Red Hat:hummingbird:1
From an advisory covering 4 CVEs
 before 0:2.4.19-4.6.hum1
0:2.4.19-4.6.hum1
cups-libs
Red Hat:hummingbird:1
From an advisory covering 4 CVEs
 before 0:2.4.19-4.6.hum1
0:2.4.19-4.6.hum1
cups-lpd
Red Hat:hummingbird:1
From an advisory covering 4 CVEs
 before 0:2.4.19-4.6.hum1
0:2.4.19-4.6.hum1
cups-printerapp
Red Hat:hummingbird:1
From an advisory covering 4 CVEs
 before 0:2.4.19-4.6.hum1
0:2.4.19-4.6.hum1
cups
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
2.1.0-4ubuntu32.1.0-52.1.0-62.1.0-6ubuntu12.1.0-7
Show 28 moreShow less
2.1.2-12.1.2-22.1.3-12.1.3-1build12.1.3-32.1.3-42.1.3-4ubuntu0.22.1.3-4ubuntu0.32.1.3-4ubuntu0.42.1.3-4ubuntu0.52.1.3-4ubuntu0.62.1.3-4ubuntu0.72.1.3-4ubuntu0.82.1.3-4ubuntu0.92.1.3-4ubuntu0.102.1.3-4ubuntu0.112.1.3-4ubuntu0.11+esm12.1.3-4ubuntu0.11+esm22.1.3-4ubuntu0.11+esm32.1.3-4ubuntu0.11+esm42.1.3-4ubuntu0.11+esm52.1.3-4ubuntu0.11+esm62.1.3-4ubuntu0.11+esm72.1.3-4ubuntu0.11+esm82.1.3-4ubuntu0.11+esm92.1.3-4ubuntu0.11+esm112.1.3-4ubuntu0.11+esm122.1.3-4ubuntu0.11+esm13
 None known
cups
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
2.2.4-7ubuntu22.2.5-22.2.6-22.2.6-32.2.6-4
Show 22 moreShow less
2.2.6-52.2.7-1ubuntu12.2.7-1ubuntu22.2.7-1ubuntu2.12.2.7-1ubuntu2.22.2.7-1ubuntu2.32.2.7-1ubuntu2.42.2.7-1ubuntu2.52.2.7-1ubuntu2.62.2.7-1ubuntu2.72.2.7-1ubuntu2.82.2.7-1ubuntu2.92.2.7-1ubuntu2.102.2.7-1ubuntu2.10+esm12.2.7-1ubuntu2.10+esm22.2.7-1ubuntu2.10+esm32.2.7-1ubuntu2.10+esm42.2.7-1ubuntu2.10+esm52.2.7-1ubuntu2.10+esm62.2.7-1ubuntu2.10+esm72.2.7-1ubuntu2.10+esm92.2.7-1ubuntu2.10+esm10
 None known
cups
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
2.2.12-2ubuntu12.3.0-62.3.0-72.3.0-7ubuntu12.3.1-1ubuntu1
Show 16 moreShow less
2.3.1-22.3.1-42.3.1-72.3.1-9ubuntu12.3.1-9ubuntu1.12.3.1-9ubuntu1.22.3.1-9ubuntu1.32.3.1-9ubuntu1.42.3.1-9ubuntu1.52.3.1-9ubuntu1.62.3.1-9ubuntu1.72.3.1-9ubuntu1.82.3.1-9ubuntu1.92.3.1-9ubuntu1.9+esm12.3.1-9ubuntu1.9+esm32.3.1-9ubuntu1.9+esm4
 None known
cups
Ubuntu:22.04:LTS
 All versions, plus listed versions
2.3.3op2-7ubuntu22.4.1op1-1ubuntu12.4.1op1-1ubuntu22.4.1op1-1ubuntu32.4.1op1-1ubuntu4
Show 14 moreShow less
2.4.1op1-1ubuntu4.12.4.1op1-1ubuntu4.22.4.1op1-1ubuntu4.42.4.1op1-1ubuntu4.62.4.1op1-1ubuntu4.72.4.1op1-1ubuntu4.82.4.1op1-1ubuntu4.92.4.1op1-1ubuntu4.102.4.1op1-1ubuntu4.112.4.1op1-1ubuntu4.122.4.1op1-1ubuntu4.152.4.1op1-1ubuntu4.162.4.1op1-1ubuntu4.202.4.1op1-1ubuntu4.21
 None known
cups
Ubuntu:24.04:LTS
 All versions, plus listed versions
2.4.6-0ubuntu32.4.7-1.2ubuntu22.4.7-1.2ubuntu32.4.7-1.2ubuntu72.4.7-1.2ubuntu7.1
Show 7 moreShow less
2.4.7-1.2ubuntu7.22.4.7-1.2ubuntu7.32.4.7-1.2ubuntu7.42.4.7-1.2ubuntu7.72.4.7-1.2ubuntu7.92.4.7-1.2ubuntu7.132.4.7-1.2ubuntu7.14
 None known
cups
Ubuntu:26.10
 All versions, plus listed versions
2.4.16-1ubuntu12.4.16-1ubuntu3
 None known
cups
Ubuntu:26.04:LTS
 All versions, plus listed versions
2.4.12-0ubuntu32.4.12-0ubuntu52.4.16-1ubuntu12.4.16-1ubuntu1.22.4.16-1ubuntu1.3
 None known
cups
openSUSE:Tumbleweed
From an advisory covering 7 CVEs
 before 2.4.20-1.1
2.4.20-1.1

History

History
RecordedChangedSources
affected
factsOSV
first indexedCVE List, EUVD, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-55480 is a medium vulnerability (CVSS 5.7) in Openprinting Cups, published October 7, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.20%, the 10th percentile. Fixed in cups 2.4.20-r0.

References

Show 52 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open