CVE-2026-55453 OpenPrinting CVE debrief

Who should care

Defenders responsible for Linux and Unix-like operating systems, particularly those using OpenPrinting CUPS, should assess exposure and verify version 2.4.20 or later is deployed. This includes operators, platform administrators, vulnerability management teams, and security teams who need to prioritize verifying and upgrading to version 2.4.20 or later, and monitor for suspicious print jobs.

Why it matters

Defenders should care because an attacker could exploit this vulnerability to inject malicious PPD keywords, potentially leading to execution in the filter context as lp. Relevant roles include defenders responsible for Linux and Unix-like operating systems, particularly those using OpenPrinting CUPS. Supported consequences include injection of malicious PPD keywords and potential execution in the filter context. Action priority follows from verifying and upgrading to version 2.4.20 or later. Evidence limits include the reporter's demonstration of injected FoomaticRIPCommandLine value consumption.

• An attacker could inject malicious PPD keywords
• A later print job could consume an injected FoomaticRIPCommandLine value
• Execution could occur in the filter context as lp

Technical summary

The quote_string() function in OpenPrinting CUPS preserves carriage-return and line-feed characters in a remote printer-controlled marker-message. This allows an attacker to inject a newline into the message, which can be parsed as a separate PPD control line and persist an attacker-selected PPD keyword. The issue is fixed in version 2.4.20. The reporter demonstrated that a later print job on a Foomatic-backed queue could consume an injected FoomaticRIPCommandLine value and execute in the filter context as lp. This vulnerability affects Linux and Unix-like operating systems using OpenPrinting CUPS, particularly those with Foomatic-backed queues.

Defensive priority

Defenders should prioritize verifying and upgrading to version 2.4.20 or later, and monitor for suspicious print jobs.

Recommended defensive actions

• Verify and upgrade to version 2.4.20 or later
• Monitor for suspicious print jobs
• Review and restrict access to print queues
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The issue is fixed in version 2.4.20. The reporter demonstrated that a later print job on a Foomatic-backed queue could consume an injected FoomaticRIPCommandLine value and execute in the filter context as lp.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.