{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-55453", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-06-16T22:10:37.607Z", "datePublished": "2026-10-15T17:11:21.208Z", "dateUpdated": "2026-10-15T17:11:21.208Z"}, "containers": {"cna": {"title": "CUPS ipp backend status-line injection can update queue PPD and lead to conditional RCE as lp via foomatic-rip", "problemTypes": [{"descriptions": [{"cweId": "CWE-74", "lang": "en", "description": "CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-77", "lang": "en", "description": "CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-78", "lang": "en", "description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 3.3, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/OpenPrinting/cups/security/advisories/GHSA-7hqf-mfhx-7r3v", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/OpenPrinting/cups/security/advisories/GHSA-7hqf-mfhx-7r3v"}, {"name": "https://github.com/OpenPrinting/cups/commit/806e1b483096c51d59432468f4afdd7387d81dd7", "tags": ["x_refsource_MISC"], "url": "https://github.com/OpenPrinting/cups/commit/806e1b483096c51d59432468f4afdd7387d81dd7"}, {"name": "https://github.com/OpenPrinting/cups/commit/d41cf0616688721e9d435d54118c4c8a36ed596a", "tags": ["x_refsource_MISC"], "url": "https://github.com/OpenPrinting/cups/commit/d41cf0616688721e9d435d54118c4c8a36ed596a"}, {"name": "https://github.com/OpenPrinting/cups/releases/tag/v2.4.20", "tags": ["x_refsource_MISC"], "url": "https://github.com/OpenPrinting/cups/releases/tag/v2.4.20"}], "affected": [{"vendor": "OpenPrinting", "product": "cups", "versions": [{"version": "< 2.4.20", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-10-15T17:11:21.208Z"}, "descriptions": [{"lang": "en", "value": "OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, the backend/ipp.c quote_string() function preserves carriage-return and line-feed characters in a remote printer-controlled marker-message before report_attr() writes the value to the scheduler status stream. The scheduler can parse an injected newline as a separate PPD: control line and persist an attacker-selected PPD keyword. The reporter demonstrated that a later print job on a Foomatic-backed queue could consume an injected FoomaticRIPCommandLine value and execute in the filter context as lp. This issue is fixed in version 2.4.20."}], "source": {"advisory": "GHSA-7hqf-mfhx-7r3v", "discovery": "UNKNOWN"}}}}

{}

{"affected": [{"affectedData": [{"product": "cups", "vendor": "OpenPrinting", "versions": [{"status": "affected", "version": "< 2.4.20"}]}], "source": "[email protected]"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, the backend/ipp.c quote_string() function preserves carriage-return and line-feed characters in a remote printer-controlled marker-message before report_attr() writes the value to the scheduler status stream. The scheduler can parse an injected newline as a separate PPD: control line and persist an attacker-selected PPD keyword. The reporter demonstrated that a later print job on a Foomatic-backed queue could consume an injected FoomaticRIPCommandLine value and execute in the filter context as lp. This issue is fixed in version 2.4.20."}], "id": "CVE-2026-55453", "lastModified": "2026-10-15T18:17:27.677", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 3.3, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 1.4, "source": "[email protected]", "type": "Secondary"}]}, "published": "2026-10-15T18:17:27.677", "references": [{"source": "[email protected]", "url": "https://github.com/OpenPrinting/cups/commit/806e1b483096c51d59432468f4afdd7387d81dd7"}, {"source": "[email protected]", "url": "https://github.com/OpenPrinting/cups/commit/d41cf0616688721e9d435d54118c4c8a36ed596a"}, {"source": "[email protected]", "url": "https://github.com/OpenPrinting/cups/releases/tag/v2.4.20"}, {"source": "[email protected]", "url": "https://github.com/OpenPrinting/cups/security/advisories/GHSA-7hqf-mfhx-7r3v"}], "sourceIdentifier": "[email protected]", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-74"}, {"lang": "en", "value": "CWE-77"}, {"lang": "en", "value": "CWE-78"}], "source": "[email protected]", "type": "Primary"}]}

{"bugzilla": {"description": "cups: cups: Arbitrary code execution via newline injection in printer status messages", "id": "2553616", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2553616"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-93", "details": ["A flaw was found in CUPS. A remote attacker controlling a network printer can achieve arbitrary code execution by returning crafted printer status messages containing newline characters. The CUPS Internet Printing Protocol (IPP) backend fails to sanitize line breaks in status attributes, allowing injected control directives to be processed by the printing scheduler. These injected directives modify local printer configuration files, causing subsequent print jobs to execute arbitrary commands with the privileges of the print service account."], "name": "CVE-2026-55453", "package_state": [{"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "cups", "product_name": "Red Hat Hardened Images"}], "public_date": "2026-10-15T17:11:21Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-55453\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-55453\nhttps://github.com/OpenPrinting/cups/commit/806e1b483096c51d59432468f4afdd7387d81dd7\nhttps://github.com/OpenPrinting/cups/commit/d41cf0616688721e9d435d54118c4c8a36ed596a\nhttps://github.com/OpenPrinting/cups/releases/tag/v2.4.20\nhttps://github.com/OpenPrinting/cups/security/advisories/GHSA-7hqf-mfhx-7r3v"], "threat_severity": "Important"}

{}