Local Privilege Escalation in OpenPrinting CUPS by Unprivileged Users

CVE-2026-34990

What is CVE-2026-34990?

OpenPrinting's CUPS, an open source printing system for Linux and other Unix-like operating systems, is susceptible to a local privilege escalation vulnerability. An unprivileged user can exploit this flaw to trick the cupsd service into authenticating with an attacker-controlled IPP service on localhost. By utilizing a reusable Authorization token, the attacker can execute administrative requests undetected. Coupled with the ability to create local printers and manipulate the FileDevice policy, an attacker can create persistent file queues that facilitate arbitrary root file overwrites, potentially allowing for command execution with root privileges. No patches are currently available for this vulnerability.

References