← Back

CVE-2026-107888

nvd nist
Published: Oct 9, 2026Modified: Oct 20, 2026

JSON object

Loading...
5.5
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Exploitability: 1.8 / Impact: 3.6
Source: NVD

Description

OpenPrinting CUPS before 2.4.20 contains a NULL pointer dereference in cupsdCheckJobs() when a job marked job-held-on-create refers to a temporary printer that has been automatically deleted. Temporary-printer cleanup can remove the destination without canceling its held jobs, and the scheduler dereferences the NULL result of cupsdFindDest() while checking holding_new_jobs. This terminates cupsd and interrupts all queues managed by that process. In some plausible scenarios, an unprivileged submission can trigger this.

Affected (1)

Products: Openprinting: Cups
Openprinting
1 product
Cups
Configuration A
1 vulnerable
Vulnerable SoftwareAffected Versions
Cups
version < 2.4.20

Related CWEs

CWE-476
NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.

References (1)

Source: cve@mitre.org
ExploitPatchVendor Advisory

Timeline

No history available yet.