CVE-2026-107888CWE-476

CVE-2026-107888

Medium · published October 9, 2026

CVSS v3.1
5.1
EPSS
0%
Percentile
0.5
In the wild
Unconfirmed
What it is

OpenPrinting CUPS before 2.4.20 contains a NULL pointer dereference in cupsdCheckJobs() when a job marked job-held-on-create refers to a temporary printer that has been automatically deleted. Temporary-printer cleanup can remove the destination without canceling its held jobs, and the scheduler dereferences the NULL result of cupsdFindDest() while checking holding_new_jobs. This terminates cupsd and interrupts all queues managed by that process. In some plausible scenarios, an unprivileged submission can trigger this.

The record
Technical detail
CVSS v3.1
5.1 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00092 · 0.5th percentile
Weakness
CWE-476 · NULL Pointer Dereference
Published
2026-10-09T09:16Z
Affected products (1)
ProductVersionsFixed in
openprinting/cups< 2.4.202.4.20
References (1)
https://github.com/OpenPrinting/cups/security/advisories/GHSA-qqm8-4q5h-jg55 · [email protected]
EPSS history
Timeline
  • 10 OCT 03:27Z
    EPSS moved — → 0%
    epss
  • 09 OCT 04:06Z
    OpenPrinting CUPS before 2.4.20 contains a NULL pointer dereference in cupsdCheckJobs() when a job marked job-held-on-create refers to a temporary printer that…
    cvelistv5
  • 09 OCT 04:06Z
    OpenPrinting CUPS before 2.4.20 contains a NULL pointer dereference in cupsdCheckJobs() when a job marked job-held-on-create refers to a temporary printer that…
    cvelistv5