Out-of-Bounds Read in OpenPrinting CUPS Affects Networked Printing Systems

CVE-2026-41079

What is CVE-2026-41079?

OpenPrinting CUPS is a widely used open-source printing system for Linux and Unix-like operating systems. A vulnerability prior to version 2.4.17 allows network-adjacent attackers to exploit the SNMP backend. By sending a specially crafted SNMP response, these attackers can trigger an out-of-bounds read operation, resulting in the leakage of up to 176 bytes of memory from the stack. This memory can include sensitive information that gets converted from UTF-16 to UTF-8, which may then be made accessible to authenticated users through IPP Get-Printer-Attributes responses and within the CUPS web interface. This issue has been rectified in version 2.4.17.

References