CVE-2026-34980 OpenPrinting CVE debrief

Who should care

System administrators and users of OpenPrinting CUPS, especially those with network-exposed cupsd instances and shared target queues, should be aware of this vulnerability and take necessary precautions. This includes reviewing and updating OpenPrinting CUPS to a version beyond 2.4.16 if possible, restricting access to cupsd instances, and monitoring print job submissions and system binary execution for suspicious activity.

Technical summary

The vulnerability exists in OpenPrinting CUPS versions 2.4.16 and prior. An unauthorized client can send a Print-Job to a shared PostScript queue without authentication. The server accepts a page-border value supplied as textWithoutLanguage, preserves an embedded newline through option escaping and reparse, and then reparses the resulting second-line PPD: text as a trusted scheduler control record. A follow-up raw print job can therefore make the server execute an attacker-chosen existing binary such as /usr/bin/vim as lp.

Defensive priority

Medium priority due to the potential for unauthorized execution of system binaries. System administrators should review and update OpenPrinting CUPS to a version beyond 2.4.16 if possible, restrict access to cupsd instances, especially those with shared target queues, and monitor print job submissions and system binary execution for suspicious activity. Additional authentication mechanisms for print job submissions should be implemented. Compensating controls for exposed systems should be reviewed while remediation is scheduled and verified. Relevant monitoring, detection, and logs for exposed assets that need extra review should be checked. Exceptions, retest remediated assets, and close the item only after evidence is documented. Asset inventory and source tracking should be considered to ensure comprehensive mitigation and response planning. Rollback change windows may be necessary for certain environments. Exposure review and compensating controls implementation are crucial steps in managing this vulnerability effectively. Vendor patch guidance should be followed closely to ensure timely and effective remediation. Monitoring and detection capabilities should be enhanced to identify potential exploitation attempts. A thorough review of the current system configuration and potential vulnerabilities is recommended to prevent similar issues in the future. The implementation of additional security measures, such as network segmentation and access controls, may be necessary to mitigate the risk associated with this vulnerability. Regular security audits and penetration testing should be conducted to identify and address potential weaknesses. The development of an incident response plan and regular training for personnel can help ensure a swift and effective response in the event of an exploitation attempt. By taking these steps, organizations can reduce the risk associated with this vulnerability and protect their systems and data. The CVE record and NVD entry provide valuable information for understanding and mitigating this vulnerability. System administrators and users of OpenPrinting CUPS should be aware of this vulnerability and take necessary precautions to

Recommended defensive actions

• Immediately review and update OpenPrinting CUPS to a version beyond 2.4.16 if possible.
• Restrict access to cupsd instances, especially those with shared target queues.
• Monitor print job submissions and system binary execution for suspicious activity.
• Implement additional authentication mechanisms for print job submissions.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Conduct a thorough review of the current system configuration and potential vulnerabilities to prevent similar issues in the future.
• Enhance monitoring and detection capabilities to identify potential exploitation attempts.

Evidence notes

The CVE record was published on 2026-04-03T22:16:27.243Z and last modified on 2026-07-24T21:10:00.143Z. The NVD entry is currently Analyzed. There are no publicly available patches at the time of publication. The vulnerability exists in OpenPrinting CUPS versions 2.4.16 and prior, and an unauthorized client can send a Print-Job to a shared PostScript queue without authentication.

Official resources