CVE-2026-41079: openprinting cups Out-of-bounds Read

Vulnerability summary

CVE-2026-41079 is a medium (CVSS 5.4) Out-of-bounds Read vulnerability in openprinting cups. EPSS estimates a 0.41% chance of exploitation in the next 30 days, higher than 33.6% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 24-04-2026
   PublishedVulnerability first disclosed.
2. 25-04-2026
   Last modifiedVulnerability information updated.

Description

OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.17, a network-adjacent attacker can send a crafted SNMP response to the CUPS SNMP backend that causes an out-of-bounds read of up to 176 bytes past a stack buffer. The leaked memory is converted from UTF-16 to UTF-8 and stored as printer supply description strings, which are subsequently visible to authenticated users via IPP Get-Printer-Attributes responses and the CUPS web interface. This vulnerability is fixed in 2.4.17.

• CWE-125Out-of-bounds ReadThe product reads data past the end, or before the beginning, of the intended buffer.
• CWE-200Exposure of Sensitive Information to an Unauthorized ActorThe product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.