CVE-2026-55480

OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems

Risk score: 41/100
CVSS: 5.7 v3.1
Exploit chance (30 days): 0.2%
Published: 15 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is: OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, copy_model() in scheduler/ipp.c creates a predictable TempDir/<connection-number>.ppd path in an lp-group-writable directory and opens it as root without O_EXCL or O_NOFOLLOW. Exploitation requires an …
Affected: Openprinting Cups before 2.4.20
Fix: Upgrade Openprinting Cups to 2.4.20 or later.
Exploitation: Public proof of concept

Story map

Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Openprinting Cups: Yellow, plan it in. OpenPrinting CUPS before 2.4.20 contains a double-free in printer-class management. When CUPS-Add-Modify-Class replaces an existing class member list, add_class() frees pclass->printers without clearing the pointer. If subsequent validation fails, the class retains the dangling pointer; CUPS-Delete-Class subsequently …

The flaws

CVE-2026-55480: OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems (CVSS 5.7 · EPSS 0%)
CVE-2026-107886: OpenPrinting CUPS before 2.4.20 contains a double-free in printer-class management (CVSS 6.5 · EPSS 0%)
CVE-2026-61702: Path traversal (CVSS 5.3 · EPSS 0%)

The fix

Upgrade Openprinting Cups: 2.4.20 or later on your release line

Who is exposed: Openprinting Cups before 2.4.20

Where it stands

Public proof of concept

Connects to

Same weakness: CWE-59 (CWE-59). 78 other warnings in 30 days
Same product: Earlier Openprinting Cups warnings. 5 in the last 90 days

Why it is Yellow

CVSS 5.7 medium
Public exploit or proof of concept referenced

References

Original description

OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, copy_model() in scheduler/ipp.c creates a predictable TempDir/<connection-number>.ppd path in an lp-group-writable directory and opens it as root without O_EXCL or O_NOFOLLOW. Exploitation requires an lp-group process able to write that directory to predict the connection-derived name and plant a symlink before the root open, while a privileged add-printer or modify-printer operation using a model PPD triggers copy_model(). The reporter treats an existing lp foothold and the privileged operation as distinct prerequisites, while the maintainer assesses high privileges because installing the relevant filter or administering the printer requires root or print-administrator access. If the race succeeds, the root scheduler follows the symlink and truncates or overwrites a root-writable target with generated PPD data, compromising file integrity or availability. This issue is fixed in version 2.4.20.

Last activity 15 Oct 2026. Patch Forecast updates every hour.