Vulnerability in OpenPrinting CUPS Printing System for Linux

CVE-2026-55467

What is CVE-2026-55467?

OpenPrinting CUPS, an open-source printing system for Unix-like operating systems, contains a vulnerability in the cupsdCreateJob option-string builder prior to version 2.4.20. This vulnerability allows an authorized user to manipulate the destination-uri and pre-dial-string values in a configured fax queue, bypassing the control-character sanitizer. This results in potential control character injection into the downstream option stream, which can be exploited by a malicious user. While the primary risk pertains to disruption of the fax queue, specific downstream filters—especially those executing shell or modem commands—could be impacted. This issue has been resolved in version 2.4.20, highlighting the importance of keeping system software updated.

References