CUPS has a use-after-free in `cupsdDeleteTemporaryPrinters` via dangling subscription pointer
Résumé
CUPS has a use-after-free in cupsdDeleteTemporaryPrinters via dangling subscription pointer
Description d'origine
La description telle que publiée par la source (souvent en anglais).
OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.16 and prior, a use-after-free vulnerability exists in the CUPS scheduler (cupsd) when temporary printers are automatically deleted. cupsdDeleteTemporaryPrinters() in scheduler/printers.c calls cupsdDeletePrinter() without first expiring subscriptions that reference the printer, leaving cupsd_subscription_t.dest as a dangling pointer to freed heap memory. The dangling pointer is subsequently dereferenced at multiple code sites, causing a crash (denial of service) of the cupsd daemon. With heap grooming, this can be leveraged for code execution.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
État des correctifs par distribution
Paquets corrigés publiés par chaque distribution pour cette CVE
- Alpine Linux ALPINE-CVE-2026-39316 cups Corrigé dans: 2.4.18-r0
- Debian DEBIAN-CVE-2026-39316 cups
- Ubuntu UBUNTU-CVE-2026-39316 cups
Références
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov