CVE-2026-34979

What it actually does

CVE-2026-34979 is a heap-based buffer overflow in the OpenPrinting CUPS scheduler in versions 2.4.16 and earlier. The flaw occurs while cupsd builds filter option strings from print job attributes. A remote, unauthenticated attacker can send a crafted IPP/HTTP print request containing maliciously formed job attributes that cause heap memory corruption in the scheduler process. Based on the published CVSS vector, the expected impact is limited availability degradation or crash of the CUPS scheduler rather than confirmed confidentiality or integrity compromise.

Why it matters to the business

Organizations running exposed CUPS print services may experience print service disruption if an attacker sends malformed print jobs that crash or destabilize the scheduler. The current public risk signal is moderate-to-low: EPSS is low and flat, there is no CISA KEV listing, no known ransomware use, and no public exploit maturity reported. However, because the issue is remotely reachable without authentication and no public patch was available at publication time, internet-exposed or broadly reachable CUPS services should be treated as higher operational risk until a vendor fix is available.

How an attack unfolds

An attacker first identifies a system running CUPS with the scheduler reachable over the network, typically via IPP on TCP port 631. The attacker then submits a crafted print job or IPP request containing abnormal job attributes designed to trigger unsafe construction of filter option strings inside cupsd. When the scheduler processes the malicious attributes, heap memory is overwritten, which can cause the scheduler to crash or become unstable. Successful exploitation would generally result in denial of print service and may produce crash artifacts, core dumps, or system logs showing cupsd termination. There are currently no publicly reported threat actors, ransomware campaigns, or public exploit kits associated with this vulnerability.

How to fix it

No publicly available fixed version was listed at publication time. Until an official OpenPrinting or operating-system vendor patch is available, reduce exposure and harden CUPS. Disable CUPS on systems that do not require printing. Restrict CUPS listeners to localhost or trusted management/print networks only, for example by avoiding public Listen or Port directives and using firewall rules to block untrusted access to TCP 631 and UDP 631. Disable printer sharing and browsing where not required. Require authentication and limit who can submit jobs, while recognizing that network-level restriction is the stronger control for this unauthenticated flaw. Monitor vendor advisories and apply the first available fixed package immediately once released. Where business requirements require continued operation, consider isolating print servers, placing them behind VPN or internal access controls, and enabling service supervision so cupsd restarts after crashes while investigation occurs.

How to confirm the fix worked

Confirm exposure by checking installed CUPS versions with package-manager queries such as rpm -q cups, dpkg -l cups, or cupsd -v, and treat OpenPrinting CUPS 2.4.16 and earlier as affected unless the operating-system vendor has backported a fix. Review cupsd configuration files, commonly /etc/cups/cupsd.conf, to confirm the service is not listening on untrusted interfaces and that remote printer sharing is disabled where unnecessary. From an untrusted network segment, verify that TCP port 631 is blocked or unreachable. After a vendor patch becomes available, confirm the installed package version or vendor backport advisory identifies the fix, restart cupsd, and perform normal print-job submission testing. Review logs after testing to ensure cupsd remains stable and no crash or memory-corruption messages appear.

Typical attack path

1. Scan for hosts exposing CUPS/IPP services, commonly on TCP port 631.
2. Fingerprint the service to confirm OpenPrinting CUPS is present and potentially version 2.4.16 or earlier.
3. Submit a crafted IPP/HTTP print job containing malicious job attributes.
4. Trigger heap memory corruption when cupsd builds filter option strings for the job.
5. Cause cupsd to crash, restart, or become unstable, disrupting printing operations.
6. Optionally repeat requests to maintain denial of service until access is blocked or the service is patched/mitigated.

How to detect it

To determine whether exploitation may already have occurred, review CUPS logs, system service logs, crash reports, and network telemetry for abnormal IPP activity followed by cupsd instability. Key log sources include /var/log/cups/error_log, /var/log/cups/access_log, systemd journal entries for cupsd.service, syslog or messages files, kernel logs for segmentation faults, and crash/core dump facilities such as systemd-coredump, ABRT, apport, or /var/lib/systemd/coredump. Look for unauthenticated or unexpected remote clients submitting print jobs shortly before cupsd crashes, repeated POST requests to IPP endpoints, malformed or unusually long job attribute values if request logging captures them, and service restart loops. Network detections should focus on unexpected hosts sending IPP traffic to TCP 631, bursts of print-job creation attempts, or IPP requests from non-print-client networks. Because no public exploit strings are known, detection should emphasize behavior: malformed job submissions, cupsd memory-corruption crashes, and repeated scheduler restarts.

• /var/log/cups/error_log
• /var/log/cups/access_log
• /etc/cups/cupsd.conf
• /usr/sbin/cupsd
• cupsd.service
• cupsd.service: Main process exited
• cupsd.service: Failed with result 'signal'
• cupsd.service: Scheduled restart job
• systemd-coredump
• /var/lib/systemd/coredump
• segfault at
• kernel: cupsd
• malloc(): corrupted
• free(): invalid
• corrupted double-linked list
• double free or corruption
• POST /printers/
• POST /ipp/print
• POST /classes/
• POST /admin/
• TCP/631
• UDP/631

What your security team should do

• Inventory Linux and Unix-like systems running CUPS and identify any installations at version 2.4.16 or earlier.
• Immediately remove internet exposure and block untrusted access to TCP 631 and UDP 631 for all CUPS servers.
• Disable CUPS on systems that do not require local or network printing.
• Restrict cupsd to localhost or trusted print networks until an official fixed version is available.
• Monitor OpenPrinting and operating-system vendor advisories for a patched release or backported security fix, then deploy it promptly.
• Add monitoring for cupsd crashes, core dumps, repeated service restarts, and unusual IPP requests or print-job submissions.
• Prioritize remediation for shared print servers, systems reachable from user networks, and any hosts where printing outages would disrupt business operations.