CVE-2026-39316

What it actually does

CVE-2026-39316 is a use-after-free in the OpenPrinting CUPS scheduler daemon, cupsd, affecting CUPS 2.4.16 and earlier. When cupsd automatically deletes temporary printers, cupsdDeleteTemporaryPrinters() calls cupsdDeletePrinter() before expiring subscriptions that still reference the printer object. Those subscriptions retain a dangling cupsd_subscription_t.dest pointer to freed heap memory. Later dereference of that stale pointer can crash cupsd, causing denial of service. The advisory notes that, with heap grooming, the memory corruption condition may be leveraged for code execution, although public exploit maturity is currently reported as none and EPSS remains very low.

Why it matters to the business

Successful exploitation can interrupt printing services on Linux and Unix-like systems, potentially disrupting business workflows that depend on local, shared, or server-managed printing. In environments where CUPS is widely deployed on workstations or print servers, even a denial-of-service condition can create operational support burden. While this vulnerability is not currently listed in CISA KEV, is not known to be ransomware-used, has very low EPSS, and has no reported mature public exploit, the possible path from crash to code execution means exposed or multi-user systems should still be remediated through normal vulnerability management timelines.

How an attack unfolds

An attacker who can interact with the local CUPS scheduler causes or waits for temporary printer objects to exist, then creates or influences subscriptions that reference one of those temporary printers. When cupsd performs automatic cleanup of temporary printers, the vulnerable code deletes the printer object without first expiring the related subscriptions. The subscription continues to hold a pointer to freed heap memory. When cupsd later processes subscription-related logic and dereferences that pointer, the daemon crashes. A more advanced attacker may attempt heap grooming so that the freed memory is replaced with attacker-influenced data before dereference, potentially turning the use-after-free into code execution in the context of the CUPS scheduler process.

How to fix it

Upgrade OpenPrinting CUPS to a vendor-fixed version when available, or apply the distribution-provided backported patch that corrects temporary-printer deletion by expiring subscriptions before freeing printer objects. Because fixed versions were not provided in the input, validate remediation against your operating system or package vendor advisory rather than relying only on the upstream version number. As interim mitigations, restrict access to cupsd to trusted local users and networks, disable unneeded printer sharing and discovery/browsing features, reduce exposure of IPP services, and consider disabling temporary printer creation where operationally feasible. Restart cupsd after patching and confirm the active daemon is the updated build.

How to confirm the fix worked

Confirm exposure by checking whether CUPS is installed and whether cupsd is running, then verify the installed package version and vendor patch status. Systems running OpenPrinting CUPS 2.4.16 or earlier should be considered affected unless the OS vendor has backported a fix. Use package-manager metadata and vendor advisories to confirm the patched build, then restart cupsd and verify the running process maps to the updated package. Review CUPS configuration to ensure unnecessary remote access, sharing, discovery, and temporary-printer behavior are disabled or restricted. Where safe in a test environment, validate that temporary printer deletion with active subscriptions no longer causes a cupsd crash.

Typical attack path

1. Identify a system running OpenPrinting CUPS 2.4.16 or earlier with the cupsd scheduler active.
2. Gain the ability to interact with the local CUPS/IPP interface or otherwise influence local print/subscription activity.
3. Cause or use an existing temporary printer object managed by cupsd.
4. Create or maintain subscriptions that reference the temporary printer.
5. Wait for or trigger automatic deletion of the temporary printer.
6. Abuse the dangling subscription reference when cupsd later dereferences the freed printer pointer.
7. Cause cupsd to crash, or in a more advanced scenario, use heap grooming to attempt code execution.

How to detect it

To determine whether exploitation already occurred, review CUPS logs, system logs, service manager logs, and crash artifacts around cupsd restarts or segmentation faults. Key sources include /var/log/cups/error_log, /var/log/cups/access_log, journald entries for cups.service or cupsd.service, syslog or messages logs, auditd process events, and coredump records. Look for cupsd crashes or core dumps shortly after temporary printer deletion, printer discovery activity, or IPP subscription operations. In access logs, review unusual local IPP operations related to printer subscriptions, especially repeated attempts around the same time as service crashes. For possible code execution, investigate any unexpected child processes of cupsd, unusual outbound network connections from cupsd, new files written by the cupsd process outside normal spool/cache/log locations, or shell execution with cupsd as the parent. No named threat actors, ransomware campaigns, or KEV exploitation are currently associated with this vulnerability in the provided data.

• cupsd
• segfault
• Segmentation fault
• core dumped
• Process cups/cupsd dumped core
• cups.service: Main process exited
• cups.service: Failed with result 'core-dump'
• cups.service: Scheduled restart job
• /var/log/cups/error_log
• /var/log/cups/access_log
• /var/spool/cups
• /var/cache/cups
• cupsdDeleteTemporaryPrinters
• cupsdDeletePrinter
• cupsd_subscription_t.dest
• Create-Printer-Subscriptions
• Get-Notifications
• Cancel-Subscription
• temporary printer
• ipp://
• ipps://

What your security team should do

• Inventory Linux and Unix-like systems running CUPS, especially print servers, multi-user systems, and workstations with cupsd enabled.
• Prioritize patching CUPS 2.4.16 and earlier through vendor packages or backported security updates.
• Restrict cupsd/IPP access to trusted hosts and users; avoid exposing CUPS management or printing services broadly.
• Disable unneeded printer discovery, sharing, and temporary-printer functionality where operationally acceptable.
• Monitor for cupsd crashes, repeated service restarts, core dumps, and suspicious subscription activity involving temporary printers.
• Treat any unexpected child process spawned by cupsd, such as a shell or network utility, as high priority because exploitation could theoretically progress beyond denial of service.
• Because EPSS is low, there is no KEV listing, and no public exploit maturity is reported, handle this as normal-priority patching unless CUPS is externally reachable, business-critical, or deployed on shared systems.