Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.0
CUPS may allow attackers to run code via crafted document
published 4 days ago
Summary
The CUPS printing system and its libppd component do not correctly check the size of data in a malicious printer description file. This can cause memory corruption and potentially let an attacker execute code on the server. Install the latest CUPS update from the vendor as soon as possible to fix the problem.
What to do
- Update cleanstart cups to version 2.4.7-r0.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| CleanStart | cleanstart | cups |
< 2.4.7-r0 Fix: upgrade to 2.4.7-r0
|
Original advisory text
Due to failure in validating the length provided by an attacker-crafted PPD PostScript document, CUPS and libppd are susceptible to a heap-based buffer overflow and possibly code execution
Security vulnerability affects the cups package. Due to failure in validating the length provided by an attacker-crafted PPD PostScript document, CUPS and libppd are susceptible to a heap-based buffer overflow and possibly code execution.
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker full control (estimated)
Timeline
Published31 Oct 2026
Updated31 Oct 2026
First seen31 Oct 2026
Sources
CLEANSTART-2026-KN78951 · OSV
Track software like this
Free during beta