CVE-2026-34980

What it actually does

CVE-2026-34980 is an improper input validation flaw in OpenPrinting CUPS 2.4.16 and earlier. When cupsd is network-exposed and has a shared PostScript print queue, an unauthenticated client can submit a Print-Job containing a crafted page-border option encoded as textWithoutLanguage. CUPS preserves an embedded newline during option escaping and reparsing, allowing attacker-controlled content after the newline to be interpreted as a trusted scheduler control record beginning with PPD:. A subsequent raw print job can cause cupsd to execute an attacker-selected existing local binary, such as /usr/bin/vim, under the lp service account. The impact is remote, unauthenticated command execution constrained to binaries already present on the server and privileges of the CUPS printing user.

Why it matters to the business

A vulnerable print server exposed to an untrusted network can be used as an entry point for unauthorized code execution, potentially disrupting printing, modifying print configuration, staging further attacks from a trusted internal system, or accessing files and services available to the lp account. Although the CVSS score is high and exploitation requires a specific shared PostScript queue configuration, there are currently no public patches listed, so organizations should prioritize exposure reduction and compensating controls. EPSS is currently low and stable, this is not listed in CISA KEV, and no ransomware use is reported, but print services are commonly overlooked and may be broadly reachable inside enterprise networks.

How an attack unfolds

An attacker first identifies a network-accessible CUPS daemon that accepts print submissions and exposes at least one shared PostScript queue. The attacker submits an unauthenticated Print-Job with a malformed page-border attribute using textWithoutLanguage content that includes an embedded newline. Because cupsd escapes and later reparses the option incorrectly, the content after the newline is treated as a separate trusted PPD scheduler control record rather than untrusted job metadata. The attacker then submits a follow-up raw print job that triggers the manipulated scheduler state. If successful, cupsd invokes an attacker-chosen existing binary on the server as the lp user. Post-exploitation activity would likely focus on persistence within files writable by lp, discovery of local configuration and print data, lateral movement from the print server, or attempts to escalate privileges using local misconfigurations.

How to fix it

At the time described, no publicly available fixed versions or patches are listed. Until vendor packages are available, reduce exposure immediately: disable sharing for unnecessary queues, especially PostScript queues; restrict cupsd/IPP access to trusted management and print client networks only; block TCP 631 from untrusted networks; require authentication for print job submission where operationally feasible; disable raw printing if not required; remove or isolate network-exposed CUPS instances; and consider stopping cupsd on systems that do not need to provide print services. Monitor OpenPrinting and operating system vendor advisories and upgrade as soon as patched CUPS packages are released. If a downstream distribution provides a backported fix, apply the vendor package even if the upstream version number appears unchanged.

How to confirm the fix worked

Confirm exposure by inventorying CUPS installations and verifying that affected versions are not running: use package manager queries such as dpkg -l cups, rpm -q cups, or equivalent OS inventory tooling, and verify cupsd version with cupsd -v where available. Review /etc/cups/cupsd.conf and queue configuration for Listen, Port, Browsing, shared printer settings, authentication requirements, and raw printing support. Confirm TCP 631 is not reachable from untrusted networks using network scanning or firewall validation. After applying mitigations or patches, verify that unauthenticated clients cannot submit jobs to shared PostScript queues and that only approved networks can reach cupsd. Review CUPS error_log and access_log after mitigation to ensure rejected submissions are logged and no unexpected jobs are accepted.

Typical attack path

1. Discover a reachable CUPS service, commonly on TCP port 631/IPP, from an adjacent or internal network.
2. Enumerate shared queues and identify a shared PostScript-capable target queue.
3. Submit an unauthenticated IPP Print-Job containing a crafted page-border option encoded as textWithoutLanguage with an embedded newline.
4. Rely on cupsd option escaping and reparsing to reinterpret the second line as a trusted PPD: scheduler control record.
5. Submit a follow-up raw print job to trigger execution of an existing local binary through the corrupted scheduler state.
6. Operate with the privileges of the lp account and attempt further discovery, persistence, data access, or privilege escalation.

How to detect it

To determine whether exploitation already occurred, review CUPS logs, job spool artifacts, and endpoint telemetry around cupsd activity. Primary log sources include /var/log/cups/access_log, /var/log/cups/error_log, /var/log/cups/page_log, systemd journal entries for cups.service, package audit logs, EDR process creation events, Linux auditd execve records, and firewall or network flow logs for IPP traffic on TCP 631. Look for unauthenticated Print-Job requests to shared PostScript queues, job attributes containing page-border or textWithoutLanguage, malformed option values with embedded newline behavior, unexpected PPD: records, and follow-up raw print jobs from the same source. On the host, investigate processes spawned by cupsd or running as lp that are not normal print filters, especially interactive tools such as /usr/bin/vim. Also review /var/spool/cups/ for recent job control and data files with suspicious attributes, /etc/cups/ppd/ for unexpected changes, and lp-owned file modifications outside normal spool and log paths. Because no named threat actors or public exploit maturity are reported, prioritize behavior-based hunting over fixed signatures.

• /var/log/cups/access_log
• /var/log/cups/error_log
• /var/log/cups/page_log
• /var/spool/cups/
• /etc/cups/ppd/
• cups.service
• cupsd
• Print-Job
• page-border
• textWithoutLanguage
• PPD:
• raw print job
• /usr/bin/vim
• user=lp
• uid=lp
• comm="cupsd"
• TCP/631
• ipp://

What your security team should do

• Identify all systems running OpenPrinting CUPS 2.4.16 or earlier, prioritizing servers reachable over the network or providing shared queues.
• Immediately restrict access to TCP 631/IPP to trusted client networks and block exposure from untrusted or adjacent networks where possible.
• Disable or unshare unnecessary print queues, with priority on shared PostScript queues and any queues accepting unauthenticated jobs.
• Require authentication for print submissions and disable raw printing unless explicitly required.
• Increase CUPS logging temporarily and collect /var/log/cups/access_log, /var/log/cups/error_log, job history, process execution telemetry, and authentication logs for review.
• Hunt for suspicious Print-Job submissions containing page-border, textWithoutLanguage, embedded newline artifacts, PPD: records, or unexpected raw jobs.
• Investigate any execution of unusual interactive editors or utilities, especially /usr/bin/vim, by the lp user or as a child of cupsd.
• Monitor vendor advisories and apply the first available fixed or backported CUPS packages promptly.
• If suspicious activity is found, isolate the print server, preserve CUPS logs and spool files, review lp-owned file changes, and perform host-level forensic triage.