CVE-2026-87875: CUPS Use-After-Free Vulnerability

CVE-2026-87875 Overview

CVE-2026-87875 is a heap out-of-bounds read vulnerability in the Common UNIX Printing System (CUPS). The cupsUTF32ToUTF8() function in cups/transcode.c lacks a source-length bound and can read past the end of the source buffer. The flaw is reachable through Simple Network Management Protocol (SNMP) supply-description parsing in backend/snmp-supplies.c when attacker-controlled content is supplied. The issue is classified under [CWE-125] Out-of-Bounds Read. Exploitation requires adjacent network access and no authentication, but impact is limited to confidentiality with no integrity or availability effect.

Critical Impact
An adjacent-network attacker can trigger a heap out-of-bounds read in CUPS by supplying crafted SNMP supply-description content, potentially leaking process memory contents from the printing backend.

Affected Products

OpenPrinting CUPS (upstream project)
Red Hat Enterprise Linux distributions bundling CUPS
Linux and UNIX systems using CUPS with the SNMP backend enabled

Discovery Timeline

2026-09-09 - CVE-2026-87875 published to the National Vulnerability Database (NVD)
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-87875

Vulnerability Analysis

The defect lives in cupsUTF32ToUTF8(), a transcoding helper in cups/transcode.c that converts UTF-32 code points to UTF-8. The function iterates over the source buffer without validating a proper source-length bound. When the CUPS SNMP backend parses supply descriptions returned by a networked printer, it feeds attacker-influenced byte sequences into this transcoder. Because the loop trusts the caller-supplied length semantics, it can walk past the allocated source region on the heap. The result is disclosure of neighboring heap memory to the printing subsystem, which may contain job metadata, credentials, or other process state. The CVSS vector indicates the attack requires adjacent network reachability, no privileges, and no user interaction, with impact limited to confidentiality.

Root Cause

The root cause is a missing source-length bound check inside cupsUTF32ToUTF8(). Combined with an incorrect UTF-32 data type on 64-bit systems, the function iterates beyond the intended end of the source buffer during transcoding.

Attack Vector

An attacker on the same broadcast domain operates a rogue or compromised device that responds to CUPS SNMP supply queries. When backend/snmp-supplies.c parses the crafted response, the malformed supply-description content drives cupsUTF32ToUTF8() to read past the source buffer, exposing adjacent heap memory.

// Patch excerpt: cups/transcode.h — Fix UTF-32 data type on 64-bit systems.
// Copyright © 2020-2024 by OpenPrinting.
+// Copyright © 2020-2026 by OpenPrinting.
 // Copyright © 2007-2011 by Apple Inc.
 // Copyright © 1997-2006 by Easy Software Products.
// Source: https://github.com/OpenPrinting/cups/commit/0c6842fc615e8afa284136a092da8178abf5f142

The upstream fix in commits 0c6842fc and 2b1dc178 corrects the UTF-32 data type definition in cups/transcode.h so the transcoder cannot overrun the source buffer on 64-bit platforms. See the OpenPrinting CUPS Commit 0c6842fc and OpenPrinting CUPS Commit 2b1dc178 for the complete patches.

Detection Methods for CVE-2026-87875

Indicators of Compromise

Unexpected SNMP responses from devices on printer VLANs containing malformed or oversized supply-description strings.
CUPS backend crashes, aborts, or AddressSanitizer reports referencing cupsUTF32ToUTF8 or snmp-supplies.c.
Unusual SNMP GET/GETNEXT traffic originating from unauthorized hosts on the print network segment.

Detection Strategies

Inspect installed CUPS package versions across Linux and UNIX hosts and compare against vendor advisories such as the Red Hat CVE-2026-87875 page.
Enable core dumps and heap sanitization in test environments to catch out-of-bounds reads originating from the CUPS SNMP backend.
Correlate print-spooler service faults with SNMP traffic captured on the same interface and timestamp.

Monitoring Recommendations

Alert on repeated segmentation faults or sd_notify failures for the cups.service and cups-browsed units.
Monitor egress SNMP traffic (udp/161, udp/162) from print servers to identify unexpected polling targets.
Log and review new printer discoveries and supply-status polls performed by CUPS backends.

How to Mitigate CVE-2026-87875

Immediate Actions Required

Apply the vendor-supplied CUPS updates that include commits 0c6842fc and 2b1dc178 as soon as they are available for your distribution.
Restrict CUPS print servers to trusted network segments and block adjacent access from untrusted VLANs.
Audit which hosts run the CUPS SNMP backend and disable it on systems that do not require printer supply monitoring.

Patch Information

Upstream fixes are tracked in the OpenPrinting Security Advisory GHSA-559w-7676-3xrq and the Red Hat Bug Report #2530994. The patches correct the UTF-32 data type in cups/transcode.h so cupsUTF32ToUTF8() no longer reads past the source buffer on 64-bit systems.

Workarounds

Disable the SNMP backend by removing execute permissions on /usr/lib/cups/backend/snmp until patches are installed.
Place printers on an isolated management VLAN and prevent unauthorized devices from responding to CUPS SNMP polls.
Filter inbound SNMP responses at the host firewall to only accept traffic from known printer IP addresses.

bash

# Temporary mitigation: disable the CUPS SNMP backend
sudo chmod 0600 /usr/lib/cups/backend/snmp
sudo systemctl restart cups