CVE-2026-41079CWE-125CWE-200

OpenPrinting CUPS: Heap out-of-bounds read in SNMP supply-level polling leaks stack memory to authenticated users

Medium · published April 24, 2026

CVSS v3.1
4.3
EPSS
0%
Percentile
34.0
In the wild
Unconfirmed
What it is

OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.17, a network-adjacent attacker can send a crafted SNMP response to the CUPS SNMP backend that causes an out-of-bounds read of up to 176 bytes past a stack buffer. The leaked memory is converted from UTF-16 to UTF-8 and stored as printer supply description strings, which are subsequently visible to authenticated users via IPP Get-Printer-Attributes responses and the CUPS web interface. This vulnerability is fixed in 2.4.17.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00409 · 34.0th percentile
Weaknesses
CWE-125 · Out-of-bounds Read; CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2026-04-24T16:54Z
EPSS history
Timeline
  • 24 APR 16:54Z
    OpenPrinting CUPS: Heap out-of-bounds read in SNMP supply-level polling leaks stack memory to authenticated users
    cvelistv5