Re: AI-discovered recent CUPS vulnerabilities going through the news

Till,

These are known low-to-moderate issues we have fixed, and those changes =
are queued up for a release as soon as Zdenek and I can resolve the CI =
issues.

As usual, the security guys are making every potential issue seem dire =
but none of these issues actually poses a serious threat.


> On Apr 15, 2026, at 10:29=E2=80=AFPM, Till Kamppeter =
<[email protected]> wrote:
>=20
> [ Resent to correct list address, pleas only answer to this one, with =
"Reply to
>  all". ]
>=20
> When chatting with the hosts of Destination Linux, they told me about =
following posts:
>=20
> https://www.theregister.com/2026/04/06/ai_agents_cups_server_rce/
>=20
> https://cyberpress.org/cups-vulnerability/
>=20
> https://cybersecuritynews.com/cups-vulnerability-remote-attack/
>=20
> =
https://www.scworld.com/brief/new-cups-vulnerabilities-threaten-rce-networ=
k-breaches
>=20
>=20
> Summary by Ryan DASgeek
> -----------------------
>=20
> -----
>=20
> The attack doesn't require a user to "click" a link or download a =
file. Instead, it exploits how Linux handles printer discovery and print =
job metadata. Here is the step-by-step breakdown of how it moves from =
the network to a root terminal:
>=20
>    Discovery (The Hook): The attacker identifies a Linux machine with =
CUPS exposed (usually on UDP port 631). They send a specially crafted =
packet that "advertises" a new, fake printer on the network. Because =
many Linux distributions have cups-browsed enabled by default for =
convenience, the computer automatically "sees" this printer and adds it =
to the system.
>=20
>    The "Page-Border" Injection (The Payload): The core of the April =
2026 issue (CVE-2026-34980) lies in how CUPS parses print options. The =
attacker sends a print job to this fake printer containing "smuggled" =
newlines within the page-border attribute. CUPS fails to sanitize these =
hidden commands.
>=20
>    Command Execution: When the system processes the job, it gets =
tricked into treating part of the malicious metadata as a trusted =
configuration file. This allows the attacker to execute commands as the =
lp (printer) user.
>=20
>    Escalation to Root (The Terminal Access): Once the attacker has a =
"foothold" as the lp user, they utilize a second flaw (CVE-2026-39316), =
which is a Use-After-Free vulnerability in the CUPS scheduler. By =
triggering a crash and memory corruption while the system is deleting =
temporary printers, the attacker can escalate their privileges from a =
restricted service account to full root access. At this point, they have =
complete control over the terminal and the entire operating system.
>=20
> -----
>=20
> Michael, I did not see that, probably due to the flood of =
bug/vulnerability report coming in in the last days due to several =
contributors using AI.
>=20
> I hope you are aware of these (or of the fact that the combination can =
lead to remote root).
>=20
> Thanks a lot, Ryan for passing this on to me.
>=20
>   Till
>=20
>=20

________________________
Michael Sweet