Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
CUPS can run attacker code through printer queue
published 4 months ago
Summary
The CUPS printing system used in Almalinux (including cups, cups-client, cups-devel, cups-filesystem, and cups-ipptool) can let anyone on the network send a specially crafted print job that triggers code to run on the server. This could let an attacker take control of the machine that handles printing. Install the latest CUPS update from Almalinux as soon as possible to close the gap.
What to do
- Update almalinux cups to version 1:2.2.6-68.el8_10.
- Update almalinux cups-client to version 1:2.2.6-68.el8_10.
- Update almalinux cups-devel to version 1:2.2.6-68.el8_10.
- Update almalinux cups-filesystem to version 1:2.2.6-68.el8_10.
- Update almalinux cups-ipptool to version 1:2.2.6-68.el8_10.
- Update almalinux cups-libs to version 1:2.2.6-68.el8_10.
- Update almalinux cups-lpd to version 1:2.2.6-68.el8_10.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| AlmaLinux:8 | almalinux | cups |
< 1:2.2.6-68.el8_10 Fix: upgrade to 1:2.2.6-68.el8_10
|
| AlmaLinux:8 | almalinux | cups-client |
< 1:2.2.6-68.el8_10 Fix: upgrade to 1:2.2.6-68.el8_10
|
| AlmaLinux:8 | almalinux | cups-devel |
< 1:2.2.6-68.el8_10 Fix: upgrade to 1:2.2.6-68.el8_10
|
| AlmaLinux:8 | almalinux | cups-filesystem |
< 1:2.2.6-68.el8_10 Fix: upgrade to 1:2.2.6-68.el8_10
|
| AlmaLinux:8 | almalinux | cups-ipptool |
< 1:2.2.6-68.el8_10 Fix: upgrade to 1:2.2.6-68.el8_10
|
| AlmaLinux:8 | almalinux | cups-libs |
< 1:2.2.6-68.el8_10 Fix: upgrade to 1:2.2.6-68.el8_10
|
| AlmaLinux:8 | almalinux | cups-lpd |
< 1:2.2.6-68.el8_10 Fix: upgrade to 1:2.2.6-68.el8_10
|
Original advisory text
Moderate: cups security update
The Common UNIX Printing System (CUPS) provides a portable printing layer for Linux, UNIX, and similar operating systems.
Security Fix(es):
* cups: OpenPrinting CUPS: Shared PostScript queue lets anonymous Print-Job requests reach `lp` code execution over the network (CVE-2026-34980)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Security Fix(es):
* cups: OpenPrinting CUPS: Shared PostScript queue lets anonymous Print-Job requests reach `lp` code execution over the network (CVE-2026-34980)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
References
- https://access.redhat.com/errata/RHSA-2026:36733 Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2026-34980 Third Party Advisory
- https://bugzilla.redhat.com/2454954 Third Party Advisory
- https://errata.almalinux.org/8/ALSA-2026-36733.html Vendor Advisory
Timeline
Published8 Jul 2026
Updated29 Oct 2026
First seen29 Oct 2026
Sources
ALSA-2026:36733 · OSV
Track software like this
Free during beta