Insecure Process Execution in PaperCut Print Deploy Client

Executive Summary

This vulnerability exists in the pc-printer-updater.exe component of the PaperCut Print Deploy Client for Windows. The application runs with high-level system privileges and tries to perform an internal validation by calling a secondary system utility using an unqualified file name.

Because it does not specify the absolute path to this utility, it relies on the operating system's default search order to find the executable. A local attacker who can modify directories in the system's search path could place a malicious binary that mimics the expected utility.

If successful, this malicious code would be executed with SYSTEM privileges, potentially leading to a full compromise of the affected host.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow a local attacker to execute malicious code with SYSTEM-level privileges on the affected machine.

Such an exploit could lead to a full compromise of the host, giving the attacker complete control over the system.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate CVE-2026-6645, users should immediately update PaperCut NG/MF to the latest patched version provided by the vendor.

This vulnerability allows unauthorized remote code execution without authentication, so applying the update promptly is critical to prevent potential full system compromise.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves the pc-printer-updater.exe component executing a secondary system utility using an unqualified file reference, which can be exploited if a malicious binary is placed in the system's search path. Detection involves checking for the presence of unauthorized or suspicious executables in directories that are part of the system's executable search path.

Suggested commands to help detect potential exploitation or presence of malicious binaries include:

• Use PowerShell or Command Prompt to list directories in the PATH environment variable: `echo %PATH%` (Windows CMD) or `$Env:Path` (PowerShell).
• Manually inspect each directory in the PATH for unexpected or suspicious executables that could mimic the expected utility.
• Use the command `where <utility_name>` to see which executable is being invoked by default.
• Check the file properties and digital signatures of the executables found to verify their legitimacy.
• Monitor process execution with tools like Sysinternals Process Monitor to detect if pc-printer-updater.exe is invoking unexpected binaries.

Useful 0 Not Useful 0