What is CVE-2017-18248?

CVE-2017-18248 is a medium-severity vulnerability in Apple Cups, classified under Improper Input Validation. CVSS score: 5.3/10. Published 2018-03-26.

How severe is CVE-2017-18248?

Medium severity. CVSS v3 base score is 5.3 out of 10.

Improper input validation in Apple Cups

CVE-2017-18248

The add_job function in scheduler/ipp.c in CUPS before 2.2.6, when D-Bus support is enabled, can be crashed by remote attackers by sending print jobs with an invalid username, related to a D-Bus notification.

Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)

Published 2018-03-26 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H.

EPSS exploit prediction

EPSS: 0.022 (81.7th percentile), scored 2026-10-02.

Low probability of exploitation in the next 30 days, but still tracked. 82nd percentile — 81.7% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.022 · newest: 0.022 · change: -0.000

Affected products

Apple Cups

Weakness classification (CWE)

CWE-20 — Improper Input Validation

References

lists.debian.org/debian-lts-announce/2018/05/msg00018.html (mailing-list)
github.com/apple/cups/issues/5143 (Exploit, Third Party Advisory)
lists.debian.org/debian-lts-announce/2018/07/msg00003.html (mailing-list)
usn.ubuntu.com/3713-1/ (vendor-advisory)
security.cucumberlinux.com/security/details.php (Exploit, Third Party Advisory)
github.com/apple/cups/releases/tag/v2.2.6 (Third Party Advisory)
github.com/apple/cups/commit/49fa4983f25b64ec29d548ffa3b9782426007df3 (Patch, Third Party Advisory)

Frequently asked questions

What is CVE-2017-18248?: CVE-2017-18248 is a medium-severity vulnerability in Apple Cups, classified under Improper Input Validation. CVSS score: 5.3/10. Published 2018-03-26.
How severe is CVE-2017-18248?: Medium severity. CVSS v3 base score is 5.3 out of 10.