CVE-2026-107655: CUPS Null Pointer Dereference DoS Vulnerability

CVE-2026-107655 Overview

CVE-2026-107655 is a null pointer dereference vulnerability in the Common UNIX Printing System (CUPS). The flaw resides in how the CUPS daemon processes embedded job ticket comments inside documents submitted through Internet Printing Protocol (IPP) requests. Specific IPP attributes are improperly handled, triggering an unhandled null pointer dereference [CWE-476]. An unauthenticated attacker able to submit jobs to a shared printer queue can crash the print daemon, interrupting printing services for all users on the host. The issue is tracked by Red Hat and OpenPrinting under advisory GHSA-58wv-9ffm-5w78.

Critical Impact

Unauthenticated attackers with access to a shared printer queue can crash the CUPS daemon, producing a temporary Denial of Service for all printing services on the affected host.

Affected Products

• OpenPrinting CUPS (versions prior to the patched commits 12237ad and 25d6830)
• Red Hat Enterprise Linux (per advisory RHSA-2026:80679)
• Linux and Unix distributions bundling vulnerable CUPS builds

Discovery Timeline

• 2026-10-09 - CVE-2026-107655 published to the National Vulnerability Database (NVD)
• 2026-10-12 - Last updated in NVD database

Technical Details for CVE-2026-107655

Vulnerability Analysis

The vulnerability exists in the CUPS daemon's handling of embedded job ticket comments within submitted print jobs. CUPS historically allowed clients to embed IPP attributes inside document data using job ticket comment syntax. When specific attributes such as attributes-charset and attributes-natural-language are provided through this channel, the server-side option table in cups/encode.c does not include matching entries, and later code paths dereference a null pointer while attempting to encode or validate them.

The practical consequence is a crash of the cupsd service. Because cupsd manages all queued and future print jobs on the host, its termination interrupts every printing operation until the service restarts. The attack requires only the ability to submit jobs to a shared queue, which is often reachable from local users or neighboring hosts on a network segment.

Root Cause

The root cause is missing option-table coverage for IPP attributes that must never be accepted from client-supplied job tickets. Without entries describing these attributes, option lookups return a null pointer that subsequent code paths dereference without checking. The upstream patch adds explicit table entries for attributes-charset and attributes-natural-language marked so they are never processed as job options, and also disables job ticket comment support by default behind a new JobTicketComments directive.

Attack Vector

An attacker crafts an IPP print job that contains an embedded job ticket comment specifying one of the mishandled attributes. The job is submitted to any accessible shared printer queue. On receipt, cupsd parses the comment, performs the faulty option lookup, and dereferences a null pointer, terminating the daemon. No authentication is required when the printer queue permits anonymous submission.

// Patch excerpt from cups/encode.c adding missing option-table entries
static const _ipp_option_t ipp_options[] =
{
  { 0, "attributes-charset",	IPP_TAG_CHARSET,	IPP_TAG_ZERO }, /* never send as option */
  { 0, "attributes-natural-language", IPP_TAG_LANGUAGE,	IPP_TAG_ZERO }, /* never send as option */
  { 1, "auth-info",		IPP_TAG_TEXT,		IPP_TAG_JOB },
  { 1, "auth-info-default",	IPP_TAG_TEXT,		IPP_TAG_PRINTER },
  { 1, "auth-info-required",	IPP_TAG_KEYWORD,	IPP_TAG_PRINTER },

Source: OpenPrinting CUPS Commit 12237ad. The patch registers the problematic attributes in the option table and marks them so they are never emitted or processed through the job option path, eliminating the null dereference.

Detection Methods for CVE-2026-107655

Indicators of Compromise

• Unexpected termination or repeated restarts of the cupsd process on print hosts.
• Core dumps or SIGSEGV entries referencing cupsd in /var/log/messages, journalctl -u cups, or systemd coredump storage.
• IPP requests in /var/log/cups/access_log containing job ticket comments immediately preceding daemon failure.
• Loss of availability for all shared print queues on an otherwise healthy host.

Detection Strategies

• Monitor the cupsd service status and alert on unexpected exits or restarts within short time windows.
• Inspect inbound IPP traffic to TCP port 631 for job submissions containing embedded job ticket comments referencing attributes-charset or attributes-natural-language.
• Correlate CUPS error log entries with network submissions from untrusted sources to identify repeated crash attempts.

Monitoring Recommendations

• Forward CUPS access and error logs to a centralized logging platform for retention and correlation.
• Baseline normal IPP submission patterns per source host and alert on sudden volume increases to shared queues.
• Track service uptime for cupsd as a key reliability metric on print servers.

How to Mitigate CVE-2026-107655

Immediate Actions Required

• Apply the vendor-provided CUPS updates referenced in Red Hat advisory RHSA-2026:80679 as soon as they are available for your distribution.
• Restrict access to the CUPS IPP listener (TCP port 631) to trusted hosts and networks using host firewall rules.
• Disable or remove shared printer queues that do not require anonymous or network submission.

Patch Information

Upstream fixes are provided in OpenPrinting CUPS commits 12237ad and 25d6830, described in OpenPrinting Security Advisory GHSA-58wv-9ffm-5w78. The second commit also introduces a new JobTicketComments configuration directive and disables job ticket comment processing by default. Red Hat distributes the fix via RHSA-2026:80679; additional vendor context is available in Red Hat CVE CVE-2026-107655 and Red Hat Bug Report #2548399.

Workarounds

• Configure the host firewall to limit CUPS port 631 access to management subnets only.
• Set printer queues to require authentication rather than permitting anonymous job submission.
• Where patched builds are unavailable, ensure the new JobTicketComments directive remains disabled once installed.

# Example: restrict CUPS IPP access with firewalld to a trusted subnet
sudo firewall-cmd --permanent --zone=public --remove-service=ipp
sudo firewall-cmd --permanent --zone=trusted --add-source=10.0.0.0/24
sudo firewall-cmd --permanent --zone=trusted --add-service=ipp
sudo firewall-cmd --reload

# Verify the CUPS daemon is running the patched version
rpm -q cups
systemctl status cups