Double-Free in OpenPrinting CUPS Printer-Class Management

Executive Summary

CVE-2026-107886 is a double-free vulnerability in OpenPrinting CUPS versions 1.4.8 through 2.4.19. It occurs during class management when CUPS-Add-Modify-Class replaces a class's printer list. The add_class() function frees the existing printers array but fails to clear the pointer. If validation fails afterward, the class retains a dangling pointer. Later, CUPS-Delete-Class triggers cupsdDeletePrinter() to free the already-freed memory, causing a double-free that crashes the CUPS scheduler.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check the installed CUPS version with 'cups-config --version' or 'dpkg -l cups'. If the version is between 1.4.8 and 2.4.19, the system is vulnerable. Monitor CUPS logs for scheduler crashes or double-free errors during class management operations.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an authorized attacker with class-management privileges (@SYSTEM) to crash the CUPS scheduler via three IPP requests, causing an authenticated denial of service. Exploitation could disrupt printing services on affected systems.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability causes a denial of service in CUPS, which could disrupt printing services in an environment. While it does not directly expose or leak data, service disruptions may impact compliance with regulations requiring reliable access to systems or documentation, such as HIPAA's access controls or GDPR's availability principles. However, the vulnerability does not directly violate these standards as it does not involve unauthorized data access or disclosure.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade CUPS to version 2.4.20 or later immediately. Restrict @SYSTEM privileges to trusted users only. Disable remote class modification if not required. Monitor for suspicious IPP requests targeting class management.

Useful 0 Not Useful 0