{"id":"CVE-2026-95511","aliases":["EUVD-2026-84335","GHSA-77q5-vf69-57rj","SUSE-SU-2026:4648-1","SUSE-SU-2026:4803-1","openSUSE-SU-2026:12092-1","openSUSE-SU-2026:22120-1"],"status":"rejected","title":"A privilege escalation vulnerability was found in CUPS when used with the cups-filters serial...","description":"Not a vulnerability. Creating a serial queue that overwrites cups-files.conf requires membership in SystemGroups (lpadmin), which is an opt-in cupsd admin role granted by a superuser. No privilege boundary is crossed.","severity":{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","level":"high","from":"ghsa"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-269"],"published":"2026-09-22T08:35:18Z","modified":"2026-10-21T20:02:16Z","fixes":[{"ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"cups-filters","fixed_in":["1.0.58-19.41.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"cups-filters","fixed_in":["1.0.58-19.41.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"cups-filters","fixed_in":["1.25.0-150200.3.34.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"cups-filters","fixed_in":["1.25.0-150200.3.34.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"cups-filters","fixed_in":["1.25.0-150200.3.34.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"cups-filters","fixed_in":["1.25.0-150200.3.34.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"cups-filters","fixed_in":["1.25.0-150200.3.34.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"cups-filters","fixed_in":["1.25.0-150200.3.34.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"cups-filters","fixed_in":["1.25.0-150200.3.34.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"cups-filters","fixed_in":["1.25.0-150200.3.34.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"cups-filters","fixed_in":["1.25.0-150200.3.34.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"cups-filters","fixed_in":["1.25.0-150200.3.34.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"cups-filters","fixed_in":["1.25.0-150200.3.34.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"cups-filters","fixed_in":["1.28.17-10.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 16.0","package":"cups-filters","fixed_in":["1.28.17-bp160.3.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"cups-filters","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.58-19.41.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"cups-filters","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.58-19.41.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"cups-filters","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.0-150200.3.34.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"cups-filters","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.0-150200.3.34.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"cups-filters","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.0-150200.3.34.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"cups-filters","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.0-150200.3.34.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"cups-filters","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.0-150200.3.34.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"cups-filters","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.0-150200.3.34.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"cups-filters","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.0-150200.3.34.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"cups-filters","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.0-150200.3.34.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"cups-filters","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.0-150200.3.34.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"cups-filters","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.0-150200.3.34.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"cups-filters","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.0-150200.3.34.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"cups-filters","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.28.17-10.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"cups-filters","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.28.17-bp160.3.1"}]}]}],"references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95511"},{"url":"https://access.redhat.com/security/cve/CVE-2026-95511"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2537749"},{"url":"https://github.com/v12-security/pocs/tree/main/cups/cups2root"},{"url":"https://github.com/advisories/GHSA-77q5-vf69-57rj"},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264648-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1282291","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-95511","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264803-1/","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-95511","description":"Not a vulnerability. Creating a serial queue that overwrites cups-files.conf requires membership in SystemGroups (lpadmin), which is an opt-in cupsd admin role granted by a superuser. No privilege boundary is crossed.","status":"rejected","published":"2026-09-22T08:35:18.354Z","modified":"2026-09-22T14:19:13.126Z","updated_at":"2026-11-02T14:20:05.505362Z"}],"euvd":[{"id":"EUVD-2026-84335","description":"Not a vulnerability. Creating a serial queue that overwrites cups-files.conf requires membership in SystemGroups (lpadmin), which is an opt-in cupsd admin role granted by a superuser. No privilege boundary is crossed.","status":"published","published":"2026-09-22T08:35:18Z","modified":"2026-09-22T14:19:13Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T17:28:03.363938Z"}],"ghsa":[{"id":"GHSA-77q5-vf69-57rj","title":"A privilege escalation vulnerability was found in CUPS when used with the cups-filters serial...","description":"A privilege escalation vulnerability was found in CUPS when used with the cups-filters serial backend. A local user who is a member of the lpadmin group can configure a printer that uses a privileged serial backend. The CUPS scheduler does not restrict the path component of non-file device URIs, so the root-privileged backend can write attacker-controlled print data to an arbitrary file. This can be used to change security-sensitive CUPS configuration and ultimately achieve root code execution. Exploitation requires local lpadmin group membership and a serial backend binary installed with root-only permissions.","status":"published","published":"2026-09-22T09:31:13Z","modified":"2026-09-22T09:31:22Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-269"],"updated_at":"2026-11-02T15:12:16.582397Z"}],"nvd":[{"id":"CVE-2026-95511","description":"Rejected reason: Not a vulnerability. Creating a serial queue that overwrites cups-files.conf requires membership in SystemGroups (lpadmin), which is an opt-in cupsd admin role granted by a superuser. No privilege boundary is crossed.","status":"rejected","published":"2026-09-22T09:17:06.217Z","modified":"2026-09-22T15:17:25.797Z","updated_at":"2026-11-02T14:12:50.368368Z"}],"osv":[{"id":"openSUSE-SU-2026:12092-1","title":"cups-filters-1.28.17-10.1 on GA media","description":"These are all security issues fixed in the cups-filters-1.28.17-10.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-09T00:00:00Z","modified":"2026-10-10T17:23:22.337417456Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"openSUSE-SU-2026:22120-1","title":"Security update for cups-filters","description":"This update for cups-filters fixes the following issues:\n\nChanges in cups-filters:\n\n- No longer provide the serial backend with 0700 permissions\n  so cupsd does no longer run it as root but as usual\n  as user 'lp' to avoid CVE-2026-95511\n  \"Root arbitrary file overwrite via serial ... device-URI path\"\n  https://github.com/OpenPrinting/cups-filters/security/advisories/GHSA-m74w-wg6q-vvpj\n  \"`lpadmin` user can escalate privileges to `root` via printers\n   that uses a privileged serial backend\" (bsc#1282291)\n  Note the general security advice in the section\n  \"Allow printer admin tasks for a normal user\" in\n  https://en.opensuse.org/SDB:CUPS_in_a_Nutshell\n\n- No longer provide any other backend with 0700 permissions\n  so cupsd does no longer run them as root but as usual\n  as user 'lp' because running something as root by default\n  is a generic security issue which we avoid now by default\n  so the user must set less secure permissions manually\n  only as specifically needed. In particular no longer provide\n  /usr/lib/cups/backend/beh\n  /usr/lib/cups/backend/cups-brf\n  /usr/lib/cups/backend/implicitclass\n  with 0700 permissions by default so in particular\n  https://bugzilla.opensuse.org/show_bug.cgi?id=1178604\n  re-appears but security by default is mandatory nowadays,\n  cf. the sections \"Security: Make Things Not Just Work\"\n  and \"Automated print queue setup via cups-browsed\" in\n  https://en.opensuse.org/SDB:CUPS_and_SANE_Firewall_settings\n","status":"published","published":"2026-10-15T22:10:08Z","modified":"2026-10-19T17:23:15.395106377Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"SUSE-SU-2026:4648-1","title":"Security update for cups-filters","description":"This update for cups-filters fixes the following issue:\n\n- CVE-2026-95511: `lpadmin` user can escalate privileges to `root` via printers that uses a privileged serial backend\n  (bsc#1282291).\n","status":"published","published":"2026-10-13T16:49:08Z","modified":"2026-10-14T17:30:08.619210169Z","updated_at":"2026-11-02T15:54:05.838224Z"},{"id":"SUSE-SU-2026:4803-1","title":"Security update for cups-filters","description":"This update for cups-filters fixes the following issue:\n\n- CVE-2026-95511: `lpadmin` user can escalate privileges to `root` via printers that uses a privileged serial backend\n  (bsc#1282291).\n","status":"published","published":"2026-10-21T08:00:05Z","modified":"2026-10-21T20:02:16.068810812Z","updated_at":"2026-11-02T15:54:05.838224Z"}]}}