CVE-2022-26691: apple cups Incorrect Comparison
CVSS: 7.2v2.0HighModified
AliasesALPINE-CVE-2022-26691MGASA-2022-0392SUSE-SU-2022:1861-1RHSA-2022:4990RHSA-2022:5054RHSA-2022:5055RHSA-2022:5056RHSA-2022:5057UBUNTU-CVE-2022-26691DEBIAN-CVE-2022-26691DLA-3029-1DSA-5149-1CGA-8fc9-5gcq-5qr7CGA-rjm8-jj4c-3cwvopenSUSE-SU-2024:12122-1
Published 26-05-2022Last modified 03-08-2024
Vulnerability summary
CVE-2022-26691 is a high (CVSS 7.2) Incorrect Comparison vulnerability in apple cups. EPSS estimates a 0.60% chance of exploitation in the next 30 days, higher than 47.3% of scored vulnerabilities.
CVSS score
7.2/10
010
High · v2.0 (NVD)EPSS score
0.60%
0%100%
Low · +0.01 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 2 · Related 4Timeline
- 26-05-2022PublishedVulnerability first disclosed.
- 03-08-2024Last modifiedVulnerability information updated.
Description
A logic issue was addressed with improved state management. This issue is fixed in Security Update 2022-003 Catalina, macOS Monterey 12.3, macOS Big Sur 11.6.5. An application may be able to gain elevated privileges.
CVSS metrics
8 scores · 7 sources · 2 versionsMedium 6.7Preferred score · OSV · Alpine (Ecosystem advisory) · calculated from vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HSourcesAll 7 agree
- OSV · Red hatEcosystem advisory · calculated6.7MediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
- OSV · UbuntuEcosystem advisory · calculated6.7MediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated6.7MediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
- OSV · WolfiEcosystem advisory · calculated6.7MediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
- OSV · ChainguardEcosystem advisory · calculated6.7MediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
- NVDNIST6.7MediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
High 7.2Preferred score · NVD (NIST)
AV:L/AC:L/Au:N/C:C/I:C/A:CSourcesSingle source
EPSS trend
Probability
0.60%
Chance of exploitation in the next 30 days
Percentile
47%
Versus all other CVEs
30-day change
+0.01 pp
From 0.58% on 18-09-2026
18-09-202618-10-2026
EPSS score0.60%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Suse24 products
- cups&distro=SUSE Enterprise Storage 6< 2.2.7-150000.3.32.1
- cups&distro=SUSE Enterprise Storage 7< 2.2.7-150000.3.32.1
- cups&distro=SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS< 2.2.7-150000.3.32.1
- cups&distro=SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS< 2.2.7-150000.3.32.1
- cups&distro=SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS< 2.2.7-150000.3.32.1
Redhat15 products
- cups< 1:2.3.3op2-13.el9_0.1 | < 1:2.2.6-28.el8_1.1 | < 1:2.2.6-33.el8_2.1 | < 1:2.2.6-45.el8_6.2 | < 1:2.2.6-38.el8_4.1
- cups-client< 1:2.3.3op2-13.el9_0.1 | < 1:2.2.6-28.el8_1.1 | < 1:2.2.6-33.el8_2.1 | < 1:2.2.6-45.el8_6.2 | < 1:2.2.6-38.el8_4.1
- cups-client-debuginfo< 1:2.3.3op2-13.el9_0.1 | < 1:2.2.6-28.el8_1.1 | < 1:2.2.6-33.el8_2.1 | < 1:2.2.6-45.el8_6.2 | < 1:2.2.6-38.el8_4.1
- cups-debuginfo< 1:2.3.3op2-13.el9_0.1 | < 1:2.2.6-28.el8_1.1 | < 1:2.2.6-33.el8_2.1 | < 1:2.2.6-45.el8_6.2 | < 1:2.2.6-38.el8_4.1
- cups-debugsource< 1:2.3.3op2-13.el9_0.1 | < 1:2.2.6-28.el8_1.1 | < 1:2.2.6-33.el8_2.1 | < 1:2.2.6-45.el8_6.2 | < 1:2.2.6-38.el8_4.1
Apple3 products
- cups< 499.4
- mac_os_x≥ 10.15, < 10.15.7 | 10.15.7 | 10.15.7:security_update_2020 | 10.15.7:security_update_2020-001 | 10.15.7:security_update_2020-005 | 10.15.7:security_update_2020-007 | 10.15.7:security_update_2021-001 | 10.15.7:security_update_2021-002 | 10.15.7:security_update_2021-003 | 10.15.7:security_update_2021-006 | 10.15.7:security_update_2021-007 | 10.15.7:security_update_2021-008 | 10.15.7:security_update_2022-001 | 10.15.7:security_update_2022-002 | 10.15.7:supplemental_update
- macos≥ unspecified, < 12.3 | ≥ unspecified, < 11.6 | ≥ unspecified, < 2022 | ≥ 11.0, < 11.6.5 | > 12.0.0, < 12.3
Opensuse3 products
- cups&distro=openSUSE Leap 15.3< 2.2.7-150000.3.32.1
- cups&distro=openSUSE Leap 15.4< 2.2.7-150000.3.32.1
- cups&distro=openSUSE Tumbleweed< 2.4.2-1.1
Debian2 products
- cups< 2.2.10-6+deb10u6 | < 2.3.3op2-3+deb11u2 | < 2.2.1-8+deb9u8 | < 2.4.2-1
- debian_linuxEOL9.0 | 10.0 | 11.0
Alpine1 product
- cups< 2.3.3-r2 | < 2.3.3-r3 | < 2.3.3-r6 | < 2.4.2-r0
Chainguard1 product
- cupsAll versions (No fix recorded)
Fedoraproject1 product
- fedoraEOL35 | 36
Mageia1 product
- cups< 2.3.3op2-1.1.mga8
Openprinting1 product
- cups< 2.4.2
Ubuntu1 product
- cups< 2.1.3-4ubuntu0.11+esm1 | < 2.2.7-1ubuntu2.9 | < 2.3.1-9ubuntu1.2 | < 2.4.1op1-1ubuntu4.1
Wolfi1 product
- cupsAll versions (No fix recorded)
12 vendors · 54 products
References
40 links
lists.debian.org/debian-lts-announce/2022/05/msg00039.htmlMailing ListX Refsource MLISTAdvisoryThird Party Advisory- www.debian.org/security/2022/dsa-5149Vendor AdvisoryX Refsource DEBIANWEBAdvisoryThird Party Advisory
- github.com/mandiant/Vulnerability-Disclosures/blob/master/2022/MNDT-2022-0026/MNDT-2022-0026.mdX Refsource MISCAdvisoryThird Party Advisory
- github.com/OpenPrinting/cups/commit/de4f8c196106033e4c372dce3e91b9d42b0b9444X Refsource MISCFIXPatchThird Party Advisory
