CVE-2026-87875

CUPS is the standards-based, open source printing system developed by Apple Inc. for UNIX®-like operating systems. CUPS uses the Internet Printing Protocol (IPP) to support printing to local and network printers..

Security Fix(es):

The cupsUTF32ToUTF8() function in CUPS's cups/transcode.c lacks a source-length bound and can read past the end of the source buffer, resulting in a heap out-of-bounds read. This is reachable via SNMP supply-description parsing in backend/snmp-supplies.c with attacker-controlled content.(CVE-2026-87875)

Two case-insensitive comparisons on request-derived usernames outside the main authorization path in CUPS's scheduler (printer ACL validation and private-attribute filtering) could allow bypass of username-based access controls in certain configurations.(CVE-2026-87876)

CUPS is the standards-based, open source printing system developed by Apple Inc. for UNIX®-like operating systems. CUPS uses the Internet Printing Protocol (IPP) to support printing to local and network printers..

Security Fix(es):

The cupsUTF32ToUTF8() function in CUPS's cups/transcode.c lacks a source-length bound and can read past the end of the source buffer, resulting in a heap out-of-bounds read. This is reachable via SNMP supply-description parsing in backend/snmp-supplies.c with attacker-controlled content.(CVE-2026-87875)

Two case-insensitive comparisons on request-derived usernames outside the main authorization path in CUPS's scheduler (printer ACL validation and private-attribute filtering) could allow bypass of username-based access controls in certain configurations.(CVE-2026-87876)

CUPS is the standards-based, open source printing system developed by Apple Inc. for UNIX®-like operating systems. CUPS uses the Internet Printing Protocol (IPP) to support printing to local and network printers..

Security Fix(es):

The cupsUTF32ToUTF8() function in CUPS's cups/transcode.c lacks a source-length bound and can read past the end of the source buffer, resulting in a heap out-of-bounds read. This is reachable via SNMP supply-description parsing in backend/snmp-supplies.c with attacker-controlled content.(CVE-2026-87875)

Two case-insensitive comparisons on request-derived usernames outside the main authorization path in CUPS's scheduler (printer ACL validation and private-attribute filtering) could allow bypass of username-based access controls in certain configurations.(CVE-2026-87876)

CUPS is the standards-based, open source printing system developed by Apple Inc. for UNIX®-like operating systems. CUPS uses the Internet Printing Protocol (IPP) to support printing to local and network printers..

Security Fix(es):

The cupsUTF32ToUTF8() function in CUPS's cups/transcode.c lacks a source-length bound and can read past the end of the source buffer, resulting in a heap out-of-bounds read. This is reachable via SNMP supply-description parsing in backend/snmp-supplies.c with attacker-controlled content.(CVE-2026-87875)

Two case-insensitive comparisons on request-derived usernames outside the main authorization path in CUPS's scheduler (printer ACL validation and private-attribute filtering) could allow bypass of username-based access controls in certain configurations.(CVE-2026-87876)

The cupsUTF32ToUTF8() function in CUPS's cups/transcode.c lacks a source-length bound and can read past the end of the source buffer, resulting in a heap out-of-bounds read. This is reachable via SNMP supply-description parsing in backend/snmp-supplies.c with attacker-controlled content.

The cupsUTF32ToUTF8() function in CUPS's cups/transcode.c lacks a source-length bound and can read past the end of the source buffer, resulting in a heap out-of-bounds read. This is reachable via SNMP supply-description parsing in backend/snmp-supplies.c with attacker-controlled content.

CUPS ipp backend status-line injection can update queue PPD and lead to conditional RCE as lp via foomatic-rip. (CVE-2026-55453) CUPS fax option values bypass the CVE-2026-34980 control-character sanitizer (incomplete fix). (CVE-2026-55467) copy_model() creates a predictable PPD tempfile without O_EXCL/O_NOFOLLOW. (CVE-2026-55480) root-side banner file disclosure. (CVE-2026-61702) Heap out-of-bounds read in cupsUTF32ToUTF8() via missing source-length bound — reachable from SNMP supply-description parsing (backend/snmp-supplies.c). (CVE-2026-87875) CVE-2026-27447 follow-up: remaining case-insensitive username matching in scheduler side paths. (CVE-2026-87876) Argument injection in mailto notifier allows unauthenticated remote code execution. (CVE-2026-105326)

These are all security issues fixed in the cups-2.4.19-3.1 package on the GA media of openSUSE Tumbleweed.

This update for cups fixes the following issue:

• CVE-2026-87875: heap out-of-bounds read in cupsUTF32ToUTF8() due to missing source-length bound can be reached via the SNMP supply-description parsing (bsc#1279945).

This update for cups fixes the following issue:

• CVE-2026-87875: heap out-of-bounds read in cupsUTF32ToUTF8() due to missing source-length bound can be reached via the SNMP supply-description parsing (bsc#1279945).

This update for cups fixes the following issue:

• CVE-2026-87875: heap out-of-bounds read in cupsUTF32ToUTF8() due to missing source-length bound can be reached via the SNMP supply-description parsing (bsc#1279945).

This update for cups fixes the following issue:

• CVE-2026-87875,GHSA-559w-7676-3xrq: heap out-of-bounds read in cupsUTF32ToUTF8() due to missing source-length bound can be reached via the SNMP supply-description parsing (bsc#1279945).

This update for cups fixes the following issue:

• CVE-2026-87875,GHSA-559w-7676-3xrq: heap out-of-bounds read in cupsUTF32ToUTF8() due to missing source-length bound can be reached via the SNMP supply-description parsing (bsc#1279945).