CVE-2026-95511
Received Received - Intake

Privilege Escalation in CUPS via Serial Backend

Publication date: 2026-09-22

Last updated on: 2026-09-22

Assigner: redhat-SADP

Description
A privilege escalation vulnerability was found in CUPS when used with the cups-filters serial backend. A local user who is a member of the lpadmin group can configure a printer that uses a privileged serial backend. The CUPS scheduler does not restrict the path component of non-file device URIs, so the root-privileged backend can write attacker-controlled print data to an arbitrary file. This can be used to change security-sensitive CUPS configuration and ultimately achieve root code execution. Exploitation requires local lpadmin group membership and a serial backend binary installed with root-only permissions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-22
Last Modified
2026-09-22
Generated
2026-09-22
AI Q&A
2026-09-22
EPSS Evaluated
N/A
NVD
CVE-2026-95511
EUVD
EUVD-2026-84335

Affected Vendors & Products

Showing 8 associated CPEs
Vendor Product Version / Range
apple cups to 10 (inc)
red_hat fedora 43
red_hat fedora 44
red_hat fedora 45
red_hat enterprise_linux 8
red_hat enterprise_linux 9
red_hat enterprise_linux 10
apple cups *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-269 The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-95511 is a privilege escalation flaw in CUPS when used with the cups-filters serial backend. A local user in the lpadmin group can configure a printer with a privileged serial backend. The CUPS scheduler does not restrict the path component of non-file device URIs, allowing the root-privileged backend to write attacker-controlled data to arbitrary files. This can modify sensitive CUPS configuration and lead to root code execution.

Detection Guidance

Check if the cups-filters package with the serial backend is installed using: rpm -qa | grep cups-filters or dpkg -l cups-filters. Verify if the lpadmin group exists and has members with: getent group lpadmin. Inspect CUPS configuration for serial backends with: lpinfo -v | grep serial. Monitor for unexpected file writes to /etc/cups/ by checking file timestamps or using auditd.

Impact Analysis

If you are a local user in the lpadmin group on an affected system, an attacker could exploit this to gain root access. This allows full control over the system, including reading or modifying sensitive files, installing malware, or disrupting services. The exploit requires the cups-filters serial backend to be installed with root permissions.

Compliance Impact

This vulnerability could lead to unauthorized root access, compromising data confidentiality and integrity. For GDPR, it may result in unauthorized access to personal data. For HIPAA, it could expose protected health information. Compliance violations may occur if the system is not properly secured or monitored.

Mitigation Strategies

Remove the cups-filters package if serial backend is unused: dnf remove cups-filters or apt remove cups-filters. Restrict lpadmin group membership to only necessary users. Set FileDevice to No in /etc/cups/cups-files.conf and restart CUPS. Change serial backend permissions to non-root if removal is not possible: chmod 0700 /usr/lib/cups/backend/serial. Keep SELinux in enforcing mode for additional restrictions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-95511. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart