{"id":"CVE-2026-87875","aliases":["AZL-100920","BELL-CVE-2026-87875","DEBIAN-CVE-2026-87875","EUVD-2026-75085","GHSA-559w-7676-3xrq","MGASA-2026-0483","OESA-2026-4138","OESA-2026-4139","OESA-2026-4140","OESA-2026-4408","RHSA-2026:66600","SUSE-SU-2026:23877-1","SUSE-SU-2026:23925-1","SUSE-SU-2026:4216-1","SUSE-SU-2026:4281-1","UBUNTU-CVE-2026-87875","openSUSE-SU-2026:11785-1","openSUSE-SU-2026:21893-1"],"status":"published","title":"Cups: openprinting cups: heap out-of-bounds read in cupsutf32toutf8() via missing source-length bound","description":"The cupsUTF32ToUTF8() function in CUPS's cups/transcode.c lacks a source-length bound and can read past the end of the source buffer, resulting in a heap out-of-bounds read. This is reachable via SNMP supply-description parsing in backend/snmp-supplies.c with attacker-controlled content.","severity":{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00392,"percentile":0.33787,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-125"],"published":"2026-09-09T16:06:27Z","modified":"2026-11-11T11:00:07Z","fixes":[{"ecosystem":"Azure Linux:3","package":"cups","fixed_in":["2.4.19-2"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"cups","fixed_in":["2.4.20-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"cups","fixed_in":["2.4.20-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"cups","fixed_in":["2.4.20-r0"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"cups","fixed_in":["2.4.20-1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"cups","fixed_in":["0:2.4.19-4.1.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"cups-client","fixed_in":["0:2.4.19-4.1.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"cups-devel","fixed_in":["0:2.4.19-4.1.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"cups-filesystem","fixed_in":["0:2.4.19-4.1.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"cups-ipptool","fixed_in":["0:2.4.19-4.1.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"cups-libs","fixed_in":["0:2.4.19-4.1.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"cups-lpd","fixed_in":["0:2.4.19-4.1.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"cups-printerapp","fixed_in":["0:2.4.19-4.1.hum1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Micro 6.0","package":"cups","fixed_in":["2.4.19-2.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Micro 6.1","package":"cups","fixed_in":["2.4.19-slfo.1.1_2.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"cups","fixed_in":["1.7.5-20.70.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"cups","fixed_in":["2.2.7-150000.3.96.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"cups","fixed_in":["2.2.7-150000.3.96.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"cups","fixed_in":["2.2.7-150000.3.96.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"cups","fixed_in":["2.2.7-150000.3.96.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP7","package":"cups","fixed_in":["2.2.7-150000.3.96.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"cups","fixed_in":["2.2.7-150000.3.96.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"cups","fixed_in":["2.4.19-3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 16.0","package":"cups","fixed_in":["2.4.19-160000.2.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:3","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.19-2"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.2-r2"},{"fixed":"2.4.20-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.11-r1"},{"fixed":"2.4.20-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.2-r5"},{"fixed":"2.4.20-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.10-1","2.4.10-2","2.4.10-3","2.4.10-4","2.4.14-1","2.4.15-1","2.4.16-1","2.4.17-1","2.4.18-1","2.4.2-3","2.4.2-3+deb12u1","2.4.2-3+deb12u2","2.4.2-3+deb12u3","2.4.2-3+deb12u4","2.4.2-3+deb12u5","2.4.2-3+deb12u6","2.4.2-3+deb12u7","2.4.2-3+deb12u8","2.4.2-3+deb12u9","2.4.2-4","2.4.2-5","2.4.2-6","2.4.20-1","2.4.7-1","2.4.7-1.1","2.4.7-1.2","2.4.7-2","2.4.7-3"]},{"source":"osv","ecosystem":"Debian:13","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.10-3","2.4.10-3+deb13u1","2.4.10-3+deb13u2","2.4.10-4","2.4.14-1","2.4.15-1","2.4.16-1","2.4.17-1","2.4.18-1","2.4.20-1"]},{"source":"osv","ecosystem":"Debian:14","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.20-1"}]}],"versions":["2.4.10-3","2.4.10-4","2.4.14-1","2.4.15-1","2.4.16-1","2.4.17-1","2.4.18-1"]},{"source":"osv","ecosystem":"Mageia:10","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.20-1.mga10"}]}],"bundled":7},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.7-17.oe2403sp3"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP4","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.7-17.oe2403sp4"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-22.oe2203sp4"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.7-16.oe2403sp1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.19-4.1.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"cups-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.19-4.1.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"cups-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.19-4.1.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"cups-filesystem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.19-4.1.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"cups-ipptool","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.19-4.1.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"cups-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.19-4.1.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"cups-lpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.19-4.1.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"cups-printerapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.19-4.1.hum1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.19-2.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.19-slfo.1.1_2.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.5-20.70.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.7-150000.3.96.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.7-150000.3.96.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.7-150000.3.96.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.7-150000.3.96.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP7","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.7-150000.3.96.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.7-150000.3.96.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.1.0-4ubuntu3","2.1.0-5","2.1.0-6","2.1.0-6ubuntu1","2.1.0-7","2.1.2-1","2.1.2-2","2.1.3-1","2.1.3-1build1","2.1.3-3","2.1.3-4","2.1.3-4ubuntu0.2","2.1.3-4ubuntu0.3","2.1.3-4ubuntu0.4","2.1.3-4ubuntu0.5","2.1.3-4ubuntu0.6","2.1.3-4ubuntu0.7","2.1.3-4ubuntu0.8","2.1.3-4ubuntu0.9","2.1.3-4ubuntu0.10","2.1.3-4ubuntu0.11","2.1.3-4ubuntu0.11+esm1","2.1.3-4ubuntu0.11+esm2","2.1.3-4ubuntu0.11+esm3","2.1.3-4ubuntu0.11+esm4","2.1.3-4ubuntu0.11+esm5","2.1.3-4ubuntu0.11+esm6","2.1.3-4ubuntu0.11+esm7","2.1.3-4ubuntu0.11+esm8","2.1.3-4ubuntu0.11+esm9","2.1.3-4ubuntu0.11+esm11","2.1.3-4ubuntu0.11+esm12","2.1.3-4ubuntu0.11+esm13"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.4-7ubuntu2","2.2.5-2","2.2.6-2","2.2.6-3","2.2.6-4","2.2.6-5","2.2.7-1ubuntu1","2.2.7-1ubuntu2","2.2.7-1ubuntu2.1","2.2.7-1ubuntu2.2","2.2.7-1ubuntu2.3","2.2.7-1ubuntu2.4","2.2.7-1ubuntu2.5","2.2.7-1ubuntu2.6","2.2.7-1ubuntu2.7","2.2.7-1ubuntu2.8","2.2.7-1ubuntu2.9","2.2.7-1ubuntu2.10","2.2.7-1ubuntu2.10+esm1","2.2.7-1ubuntu2.10+esm2","2.2.7-1ubuntu2.10+esm3","2.2.7-1ubuntu2.10+esm4","2.2.7-1ubuntu2.10+esm5","2.2.7-1ubuntu2.10+esm6","2.2.7-1ubuntu2.10+esm7","2.2.7-1ubuntu2.10+esm9","2.2.7-1ubuntu2.10+esm10"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.12-2ubuntu1","2.3.0-6","2.3.0-7","2.3.0-7ubuntu1","2.3.1-1ubuntu1","2.3.1-2","2.3.1-4","2.3.1-7","2.3.1-9ubuntu1","2.3.1-9ubuntu1.1","2.3.1-9ubuntu1.2","2.3.1-9ubuntu1.3","2.3.1-9ubuntu1.4","2.3.1-9ubuntu1.5","2.3.1-9ubuntu1.6","2.3.1-9ubuntu1.7","2.3.1-9ubuntu1.8","2.3.1-9ubuntu1.9","2.3.1-9ubuntu1.9+esm1","2.3.1-9ubuntu1.9+esm3","2.3.1-9ubuntu1.9+esm4"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.3.3op2-7ubuntu2","2.4.1op1-1ubuntu1","2.4.1op1-1ubuntu2","2.4.1op1-1ubuntu3","2.4.1op1-1ubuntu4","2.4.1op1-1ubuntu4.1","2.4.1op1-1ubuntu4.2","2.4.1op1-1ubuntu4.4","2.4.1op1-1ubuntu4.6","2.4.1op1-1ubuntu4.7","2.4.1op1-1ubuntu4.8","2.4.1op1-1ubuntu4.9","2.4.1op1-1ubuntu4.10","2.4.1op1-1ubuntu4.11","2.4.1op1-1ubuntu4.12","2.4.1op1-1ubuntu4.15","2.4.1op1-1ubuntu4.16","2.4.1op1-1ubuntu4.20","2.4.1op1-1ubuntu4.21"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.6-0ubuntu3","2.4.7-1.2ubuntu2","2.4.7-1.2ubuntu3","2.4.7-1.2ubuntu7","2.4.7-1.2ubuntu7.1","2.4.7-1.2ubuntu7.2","2.4.7-1.2ubuntu7.3","2.4.7-1.2ubuntu7.4","2.4.7-1.2ubuntu7.7","2.4.7-1.2ubuntu7.9","2.4.7-1.2ubuntu7.13","2.4.7-1.2ubuntu7.14"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.16-1ubuntu1","2.4.16-1ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.12-0ubuntu3","2.4.12-0ubuntu5","2.4.16-1ubuntu1","2.4.16-1ubuntu1.2","2.4.16-1ubuntu1.3"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.19-3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.19-160000.2.1"}]}]}],"products":[{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 6"},{"vendor":"red hat","product":"red hat enterprise linux 7"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"red hat","product":"red hat hardened images"},{"vendor":"red hat","product":"red hat openshift container platform 4"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:66600","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-87875","tags":["vdb-entry","x_refsource_REDHAT","advisory","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2530994","tags":["issue-tracking","x_refsource_REDHAT","report"]},{"url":"https://github.com/OpenPrinting/cups/commit/0c6842fc615e8afa284136a092da8178abf5f142","tags":["fix","article"]},{"url":"https://github.com/OpenPrinting/cups/commit/2b1dc178a2d2325135b855142e384f4e8c42d8e4","tags":["fix","article"]},{"url":"https://github.com/OpenPrinting/cups/security/advisories/GHSA-559w-7676-3xrq","tags":["exploit","advisory","article","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87875","tags":["web","advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-87875","tags":["advisory"]},{"url":"https://access.redhat.com/downloads/content/package-browser/","tags":["web"]},{"url":"https://catalog.redhat.com/software/containers/","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/87xxx/CVE-2026-87875.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-87875","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0483.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=36331","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/KX5YFUOJ5JKV64QGD4WMERKGBI43OV3M/","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2026/10/05/6","tags":["web"]},{"url":"https://github.com/OpenPrinting/cups/security/advisories/GHSA-jj94-x3qh-ffp9","tags":["advisory"]},{"url":"https://github.com/OpenPrinting/cups/security/advisories/GHSA-7j85-5r23-xhvh","tags":["advisory"]},{"url":"https://github.com/OpenPrinting/cups/security/advisories/GHSA-gq9p-4w7m-2f5g","tags":["advisory"]},{"url":"https://github.com/OpenPrinting/cups/security/advisories/GHSA-w9hj-hq9p-m7f6","tags":["advisory"]},{"url":"https://github.com/OpenPrinting/cups/security/advisories/GHSA-qqm8-4q5h-jg55","tags":["advisory"]},{"url":"https://github.com/OpenPrinting/cups/security/advisories/GHSA-fw7q-ww8w-phx8","tags":["advisory"]},{"url":"https://github.com/OpenPrinting/cups/security/advisories/GHSA-wjc4-qhjr-5m5x","tags":["advisory"]},{"url":"https://github.com/OpenPrinting/cups/security/advisories/GHSA-7hqf-mfhx-7r3v","tags":["advisory"]},{"url":"https://github.com/OpenPrinting/cups/security/advisories/GHSA-gj33-wxpv-6fgg","tags":["advisory"]},{"url":"https://github.com/OpenPrinting/cups/security/advisories/GHSA-r8jp-q6fh-g5r2","tags":["advisory"]},{"url":"https://github.com/OpenPrinting/cups/security/advisories/GHSA-r4wf-366f-f6g3","tags":["advisory"]},{"url":"https://github.com/OpenPrinting/cups/security/advisories/GHSA-69qc-prxg-h2c7","tags":["advisory"]},{"url":"https://github.com/OpenPrinting/cups/security/advisories/GHSA-pwg4-pv39-8c22","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4138","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87876","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4139","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4140","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4408","tags":["advisory"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_66600.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-87875","tags":["advisory","report"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623877-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1279945","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-87875","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623925-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264216-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264281-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-87875","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-87875","title":"Cups: openprinting cups: heap out-of-bounds read in cupsutf32toutf8() via missing source-length bound","description":"The cupsUTF32ToUTF8() function in CUPS's cups/transcode.c lacks a source-length bound and can read past the end of the source buffer, resulting in a heap out-of-bounds read. This is reachable via SNMP supply-description parsing in backend/snmp-supplies.c with attacker-controlled content.","status":"published","published":"2026-09-09T16:06:27.371Z","modified":"2026-11-06T01:12:50.512Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-125"],"updated_at":"2026-11-06T02:55:55.947181Z"}],"euvd":[{"id":"EUVD-2026-75085","description":"The cupsUTF32ToUTF8() function in CUPS's cups/transcode.c lacks a source-length bound and can read past the end of the source buffer, resulting in a heap out-of-bounds read. This is reachable via SNMP supply-description parsing in backend/snmp-supplies.c with attacker-controlled content.","status":"published","published":"2026-09-09T16:06:27Z","modified":"2026-11-06T01:12:50Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-06T02:02:53.341523Z"}],"nvd":[{"id":"CVE-2026-87875","description":"The cupsUTF32ToUTF8() function in CUPS's cups/transcode.c lacks a source-length bound and can read past the end of the source buffer, resulting in a heap out-of-bounds read. This is reachable via SNMP supply-description parsing in backend/snmp-supplies.c with attacker-controlled content.","status":"published","published":"2026-09-09T17:17:53.24Z","modified":"2026-11-06T02:17:54.393Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-125"],"updated_at":"2026-11-06T06:59:05.303911Z"}],"osv":[{"id":"BELL-CVE-2026-87875","status":"published","published":"2026-09-11T06:10:23.471181Z","modified":"2026-10-16T07:15:04.565099357Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:28:26.630331Z"},{"id":"CVE-2026-87875","title":"Cups: openprinting cups: heap out-of-bounds read in cupsutf32toutf8() via missing source-length bound","description":"The cupsUTF32ToUTF8() function in CUPS's cups/transcode.c lacks a source-length bound and can read past the end of the source buffer, resulting in a heap out-of-bounds read. This is reachable via SNMP supply-description parsing in backend/snmp-supplies.c with attacker-controlled content.","status":"published","published":"2026-09-09T16:06:27.371Z","modified":"2026-11-07T07:06:51.781305693Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-125"],"updated_at":"2026-11-07T03:08:11.522761Z"},{"id":"DEBIAN-CVE-2026-87875","description":"The cupsUTF32ToUTF8() function in CUPS's cups/transcode.c lacks a source-length bound and can read past the end of the source buffer, resulting in a heap out-of-bounds read. This is reachable via SNMP supply-description parsing in backend/snmp-supplies.c with attacker-controlled content.","status":"published","published":"2026-09-09T17:17:53.24Z","modified":"2026-11-11T11:00:07.891909737Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-11T11:06:10.823198Z"},{"id":"OESA-2026-4138","title":"cups security update","description":"CUPS is the standards-based, open source printing system developed by Apple Inc. for UNIX®-like operating systems. CUPS uses the Internet Printing Protocol (IPP) to support printing to local and network printers..\r\n\r\nSecurity Fix(es):\n\nThe cupsUTF32ToUTF8() function in CUPS\u0026apos;s cups/transcode.c lacks a source-length bound and can read past the end of the source buffer, resulting in a heap out-of-bounds read. This is reachable via SNMP supply-description parsing in backend/snmp-supplies.c with attacker-controlled content.(CVE-2026-87875)\n\nTwo case-insensitive comparisons on request-derived usernames outside the main authorization path in CUPS\u0026apos;s scheduler (printer ACL validation and private-attribute filtering) could allow bypass of username-based access controls in certain configurations.(CVE-2026-87876)","status":"published","published":"2026-09-30T13:46:58Z","modified":"2026-10-01T02:00:05.370560769Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:47.643553Z"},{"id":"OESA-2026-4139","title":"cups security update","description":"CUPS is the standards-based, open source printing system developed by Apple Inc. for UNIX®-like operating systems. CUPS uses the Internet Printing Protocol (IPP) to support printing to local and network printers..\r\n\r\nSecurity Fix(es):\n\nThe cupsUTF32ToUTF8() function in CUPS\u0026apos;s cups/transcode.c lacks a source-length bound and can read past the end of the source buffer, resulting in a heap out-of-bounds read. This is reachable via SNMP supply-description parsing in backend/snmp-supplies.c with attacker-controlled content.(CVE-2026-87875)\n\nTwo case-insensitive comparisons on request-derived usernames outside the main authorization path in CUPS\u0026apos;s scheduler (printer ACL validation and private-attribute filtering) could allow bypass of username-based access controls in certain configurations.(CVE-2026-87876)","status":"published","published":"2026-09-30T13:46:58Z","modified":"2026-10-01T02:00:06.078173707Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:47.643553Z"},{"id":"OESA-2026-4140","title":"cups security update","description":"CUPS is the standards-based, open source printing system developed by Apple Inc. for UNIX®-like operating systems. CUPS uses the Internet Printing Protocol (IPP) to support printing to local and network printers..\r\n\r\nSecurity Fix(es):\n\nThe cupsUTF32ToUTF8() function in CUPS\u0026apos;s cups/transcode.c lacks a source-length bound and can read past the end of the source buffer, resulting in a heap out-of-bounds read. This is reachable via SNMP supply-description parsing in backend/snmp-supplies.c with attacker-controlled content.(CVE-2026-87875)\n\nTwo case-insensitive comparisons on request-derived usernames outside the main authorization path in CUPS\u0026apos;s scheduler (printer ACL validation and private-attribute filtering) could allow bypass of username-based access controls in certain configurations.(CVE-2026-87876)","status":"published","published":"2026-09-30T13:46:59Z","modified":"2026-10-01T02:00:04.210482423Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:47.643553Z"},{"id":"OESA-2026-4408","title":"cups security update","description":"CUPS is the standards-based, open source printing system developed by Apple Inc. for UNIX®-like operating systems. CUPS uses the Internet Printing Protocol (IPP) to support printing to local and network printers..\r\n\r\nSecurity Fix(es):\n\nThe cupsUTF32ToUTF8() function in CUPS\u0026apos;s cups/transcode.c lacks a source-length bound and can read past the end of the source buffer, resulting in a heap out-of-bounds read. This is reachable via SNMP supply-description parsing in backend/snmp-supplies.c with attacker-controlled content.(CVE-2026-87875)\n\nTwo case-insensitive comparisons on request-derived usernames outside the main authorization path in CUPS\u0026apos;s scheduler (printer ACL validation and private-attribute filtering) could allow bypass of username-based access controls in certain configurations.(CVE-2026-87876)","status":"published","published":"2026-10-16T12:00:17Z","modified":"2026-10-16T12:15:20.371041112Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:47.981622Z"},{"id":"RHSA-2026:66600","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-09-12T10:10:21Z","modified":"2026-10-17T10:17:55Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"UBUNTU-CVE-2026-87875","description":"The cupsUTF32ToUTF8() function in CUPS's cups/transcode.c lacks a source-length bound and can read past the end of the source buffer, resulting in a heap out-of-bounds read. This is reachable via SNMP supply-description parsing in backend/snmp-supplies.c with attacker-controlled content.","status":"published","published":"2026-09-09T17:17:00Z","modified":"2026-10-17T13:01:15.214489058Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T16:57:24.828975Z"},{"id":"AZL-100920","title":"CVE-2026-87875 affecting package cups for versions less than 2.4.19-2","description":"The cupsUTF32ToUTF8() function in CUPS's cups/transcode.c lacks a source-length bound and can read past the end of the source buffer, resulting in a heap out-of-bounds read. This is reachable via SNMP supply-description parsing in backend/snmp-supplies.c with attacker-controlled content.","status":"published","published":"2026-09-09T17:17:53Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:17.128158Z"},{"id":"MGASA-2026-0483","title":"Updated cups package fixes security vulnerabilities","description":"CUPS ipp backend status-line injection can update queue PPD and lead to\nconditional RCE as lp via foomatic-rip. (CVE-2026-55453)\nCUPS fax option values bypass the CVE-2026-34980 control-character\nsanitizer (incomplete fix). (CVE-2026-55467)\ncopy_model() creates a predictable PPD tempfile without\nO_EXCL/O_NOFOLLOW. (CVE-2026-55480)\nroot-side banner file disclosure. (CVE-2026-61702)\nHeap out-of-bounds read in cupsUTF32ToUTF8() via missing source-length\nbound — reachable from SNMP supply-description parsing\n(backend/snmp-supplies.c). (CVE-2026-87875)\nCVE-2026-27447 follow-up: remaining case-insensitive username matching\nin scheduler side paths. (CVE-2026-87876)\nArgument injection in mailto notifier allows unauthenticated remote code\nexecution. (CVE-2026-105326)\n","status":"published","published":"2026-10-12T18:47:12Z","modified":"2026-10-12T19:13:25.022728597Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"openSUSE-SU-2026:11785-1","title":"cups-2.4.19-3.1 on GA media","description":"These are all security issues fixed in the cups-2.4.19-3.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-09-15T00:00:00Z","modified":"2026-09-16T18:23:08.454746205Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:21893-1","title":"Security update for cups","description":"This update for cups fixes the following issue:\n\n- CVE-2026-87875: heap out-of-bounds read in `cupsUTF32ToUTF8()` due to missing source-length bound can be reached via\n  the SNMP supply-description parsing (bsc#1279945).\n","status":"published","published":"2026-09-20T17:41:54Z","modified":"2026-09-25T18:23:11.53146291Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"SUSE-SU-2026:23877-1","title":"Security update for cups","description":"This update for cups fixes the following issue:\n\n- CVE-2026-87875: heap out-of-bounds read in `cupsUTF32ToUTF8()` due to missing source-length bound can be reached via\n  the SNMP supply-description parsing (bsc#1279945).\n","status":"published","published":"2026-09-21T07:57:09Z","modified":"2026-09-28T18:23:12.552780594Z","updated_at":"2026-11-02T15:54:03.991985Z"},{"id":"SUSE-SU-2026:23925-1","title":"Security update for cups","description":"This update for cups fixes the following issue:\n\n- CVE-2026-87875: heap out-of-bounds read in `cupsUTF32ToUTF8()` due to missing source-length bound can be reached via\n  the SNMP supply-description parsing (bsc#1279945).\n","status":"published","published":"2026-09-21T07:56:40Z","modified":"2026-09-30T18:23:13.129679871Z","updated_at":"2026-11-02T15:54:03.991985Z"},{"id":"SUSE-SU-2026:4216-1","title":"Security update for cups","description":"This update for cups fixes the following issue:\n\n- CVE-2026-87875,GHSA-559w-7676-3xrq: heap out-of-bounds read in `cupsUTF32ToUTF8()` due to missing source-length bound\n  can be reached via the SNMP supply-description parsing (bsc#1279945).\n","status":"published","published":"2026-09-16T13:44:41Z","modified":"2026-09-17T09:45:03.942405868Z","updated_at":"2026-11-02T15:54:05.392906Z"},{"id":"SUSE-SU-2026:4281-1","title":"Security update for cups","description":"This update for cups fixes the following issue:\n\n- CVE-2026-87875,GHSA-559w-7676-3xrq: heap out-of-bounds read in `cupsUTF32ToUTF8()` due to missing source-length bound\n  can be reached via the SNMP supply-description parsing (bsc#1279945).\n","status":"published","published":"2026-09-22T08:33:18Z","modified":"2026-09-23T09:15:05.355886764Z","updated_at":"2026-11-02T15:54:05.838224Z"}]}}