CVE-2026-107886

OpenPrinting CUPS before 2.4.20 contains a double-free in printer-class management

Risk score: 46/100
CVSS: 6.5 v3.1
Exploit chance (30 days): 0.2%
Published: 9 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is: OpenPrinting CUPS before 2.4.20 contains a double-free in printer-class management. When CUPS-Add-Modify-Class replaces an existing class member list, add_class() frees pclass->printers without clearing the pointer. If subsequent validation fails, the class retains the dangling pointer; CUPS-Delete-Class subsequently …
Affected: Openprinting Cups before 2.4.20
Fix: Upgrade Openprinting Cups to 2.4.20 or later.
Exploitation: Public proof of concept

Story map

Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Openprinting Cups: Yellow, plan it in. OpenPrinting CUPS before 2.4.20 contains a double-free in printer-class management. When CUPS-Add-Modify-Class replaces an existing class member list, add_class() frees pclass->printers without clearing the pointer. If subsequent validation fails, the class retains the dangling pointer; CUPS-Delete-Class subsequently …

The flaws

CVE-2026-107886: OpenPrinting CUPS before 2.4.20 contains a double-free in printer-class management (CVSS 6.5 · EPSS 0%)
CVE-2026-61702: Path traversal (CVSS 5.3 · EPSS 0%)
CVE-2026-55480: OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems (CVSS 5.7 · EPSS 0%)

The fix

Upgrade Openprinting Cups: 2.4.20 or later on your release line

Who is exposed: Openprinting Cups before 2.4.20

Where it stands

Public proof of concept

Connects to

Same weakness: Double free (CWE-415). 36 other warnings in 30 days
Same product: Earlier Openprinting Cups warnings. 5 in the last 90 days

Why it is Yellow

CVSS 6.5 medium
Public exploit or proof of concept referenced

References

Original description

OpenPrinting CUPS before 2.4.20 contains a double-free in printer-class management. When CUPS-Add-Modify-Class replaces an existing class member list, add_class() frees pclass->printers without clearing the pointer. If subsequent validation fails, the class retains the dangling pointer; CUPS-Delete-Class subsequently frees the same allocation in cupsdDeletePrinter(). A client authorized to modify and delete classes can cause scheduler-wide denial of service. The default policy requires @SYSTEM privileges.

Last activity 9 Oct 2026. Patch Forecast updates every hour.