NULL pointer dereference in Openprinting Cups
CVE-2026-107890
OpenPrinting CUPS before 2.4.20 contains a NULL pointer dereference caused by repeated IPP group tags in job-creation requests. IPP parsing creates unnamed separator attributes with IPP_TAG_ZERO, but add_job() converts these separators to IPP_TAG_JOB. During job startup, get_options()/ipp_length() subsequently calls strlen() on a NULL attribute name, terminating cupsd and disrupting all queues. A single crafted Print-Job request can trigger the crash when the client can reach the scheduler and submit jobs to an accepting, enabled queue supporting the submitted document format. Anonymous submission is possible when permitted by listener and access-control configuration.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 3.3 (Low). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L.
EPSS exploit prediction
No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.
Affected products
Weakness classification (CWE)
References
- github.com/OpenPrinting/cups/security/advisories/GHSA-wjc4-qhjr-5m5x (vendor-advisory)
Frequently asked questions
- What is CVE-2026-107890?
- CVE-2026-107890 is a low-severity vulnerability in Openprinting Cups, classified under NULL Pointer Dereference. CVSS score: 3.3/10. Published 2026-10-09.
- How severe is CVE-2026-107890?
- Low severity. CVSS v3 base score is 3.3 out of 10.