CVE-2026-41079

Publication date 24 April 2026

Last updated 8 June 2026

Ubuntu priority

Cvss 3 Severity Score

Description

OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.17, a network-adjacent attacker can send a crafted SNMP response to the CUPS SNMP backend that causes an out-of-bounds read of up to 176 bytes past a stack buffer. The leaked memory is converted from UTF-16 to UTF-8 and stored as printer supply description strings, which are subsequently visible to authenticated users via IPP Get-Printer-Attributes responses and the CUPS web interface. This vulnerability is fixed in 2.4.17.

Status

Show unmaintained releases

Package	Ubuntu Release	Status
cups	26.04 LTS resolute	Fixed 2.4.16-1ubuntu1.2
	25.10 questing	Fixed 2.4.12-0ubuntu3.9
	24.04 LTS noble	Fixed 2.4.7-1.2ubuntu7.13
	22.04 LTS jammy	Fixed 2.4.1op1-1ubuntu4.20
	20.04 LTS focal	Vulnerable
	18.04 LTS bionic	Vulnerable
	16.04 LTS xenial	Vulnerable

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package	Patch details
cups	Upstream: b7c2525

Severity score breakdown

Parameter	Value
Base score	4.3 · Medium
Attack vector	Adjacent
Attack complexity	Low
Privileges required	None
User interaction	None
Scope	Unchanged
Confidentiality	Low
Integrity impact	None
Availability impact	None
Vector	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References

Related Ubuntu Security Notices (USN)

USN-8405-1
CUPS vulnerabilities
8 June 2026