CVE-2026-55467

OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, the cupsdCreateJob option-string builder in scheduler/job.c maps attacker-controlled destination-uri and pre-dial-string values from a configured fax queue to the phone and faxPrefix options. Unlike ordinary IPP job attributes, these mapped fax values bypass the control-character sanitizer and are copied directly into the filter options argument. A user permitted to submit a job can therefore inject control characters into the downstream option stream. The reporter states that a downstream fax filter passing these values to a shell or modem command could execute code as lp, while the maintainer states that CUPS has no confidentiality or integrity impact because the only known code-executing filter is optional Foomatic and addressed separately, leaving possible disruption of the affected queue. This issue is fixed in version 2.4.20.

Database specific

{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-150",
        "CWE-93",
        "CWE-94"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55467.json"
}

References

Affected packages

Git / github.com/openprinting/cups

Affected ranges

Type

GIT

Repo

https://github.com/openprinting/cups

Events

Introduced

Fixed

ef80eeaea51430a055948240eea3f28ef5354edf

Fixed

0cf4e7814d6810ed3c454222bce3aa342d541681

Fixed

a9e7e7a3a019d0fa063d29409d3f82e4c6d5a008

Database specific

Show details

{
    "extracted_events": [
        {
            "cpe": "cpe:2.3:a:openprinting:cups:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "fixed": "2.4.20"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "range": [
                {
                    "fixed": "0cf4e7814d6810ed3c454222bce3aa342d541681"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "range": [
                {
                    "fixed": "a9e7e7a3a019d0fa063d29409d3f82e4c6d5a008"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "original_tag": "v2.4.20",
            "range": [
                {
                    "fixed": "ef80eeaea51430a055948240eea3f28ef5354edf"
                }
            ],
            "source": "REFERENCES_TAG"
        }
    ]
}

Affected versions

v2.*

v2.2.0

v2.2.1

v2.2.2

v2.2.3

v2.2.4

v2.2.5

v2.2.6

v2.2b1

v2.2b2

v2.2rc1

v2.3.0

v2.3.1

v2.3.3

v2.3.3op1

v2.3.3op2

v2.3b1

v2.3b2

v2.3b3

v2.3b4

v2.3b5

v2.3b6

v2.3b7

v2.3b8

v2.3rc1

v2.4.0

v2.4.1

v2.4.10

v2.4.11

v2.4.12

v2.4.13

v2.4.14

v2.4.15

v2.4.16

v2.4.17

v2.4.18

v2.4.19

v2.4.2

v2.4.3

v2.4.4

v2.4.5

v2.4.6

v2.4.7

v2.4.8

v2.4.9

v2.4b1

v2.4rc1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55467.json"

vanir_signatures

[
    {
        "deprecated": false,
        "digest": {
            "function_hash": "260624071152669026496669841050474611317",
            "length": 12804
        },
        "id": "CVE-2026-55467-2c894b45",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/openprinting/cups/commit/0cf4e7814d6810ed3c454222bce3aa342d541681",
        "target": {
            "file": "scheduler/job.c",
            "function": "get_options"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "90561137624800130613202583227874487818",
                "321345419874437583998488118523744950285",
                "339631098780829551144978146737851750424",
                "145790470904750311815179375130972722087",
                "324659897058736019312628089003650658129",
                "191855940688960590226776925176114410293",
                "245145855458893716856745612840592862175",
                "280845991610428926847257060357984878508"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-55467-3b83d8f4",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/openprinting/cups/commit/0cf4e7814d6810ed3c454222bce3aa342d541681",
        "target": {
            "file": "scheduler/job.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "295690434730412894454811293427861416258",
            "length": 13819
        },
        "id": "CVE-2026-55467-60a8a373",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/openprinting/cups/commit/a9e7e7a3a019d0fa063d29409d3f82e4c6d5a008",
        "target": {
            "file": "scheduler/job.c",
            "function": "get_options"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "90561137624800130613202583227874487818",
                "321345419874437583998488118523744950285",
                "339631098780829551144978146737851750424",
                "145790470904750311815179375130972722087",
                "324659897058736019312628089003650658129",
                "191855940688960590226776925176114410293",
                "245145855458893716856745612840592862175",
                "280845991610428926847257060357984878508"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-55467-ebbabfcd",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/openprinting/cups/commit/a9e7e7a3a019d0fa063d29409d3f82e4c6d5a008",
        "target": {
            "file": "scheduler/job.c"
        }
    }
]

vanir_signatures_modified

"2026-10-28T11:14:50Z"