CVE-2026-87875: cups Out-of-bounds Read

Vulnerability summary

CVE-2026-87875 is a medium (CVSS 4.3) Out-of-bounds Read vulnerability in cups. EPSS estimates a 0.39% chance of exploitation in the next 30 days, higher than 31.8% of scored vulnerabilities.

Timeline

1. 09-09-2026
   PublishedVulnerability first disclosed.
2. 11-09-2026
   Last modifiedVulnerability information updated.

Description

The cupsUTF32ToUTF8() function in CUPS's cups/transcode.c lacks a source-length bound and can read past the end of the source buffer, resulting in a heap out-of-bounds read. This is reachable via SNMP supply-description parsing in backend/snmp-supplies.c with attacker-controlled content.

• CWE-125Out-of-bounds ReadThe product reads data past the end, or before the beginning, of the intended buffer.