CVE-2026-107888
cups: CUPS: Denial of Service via deleted temporary printer
Severity
ModerateRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · October 9, 2026
Updated · October 21, 2026
Description
A flaw was found in CUPS. An attacker with access to the local print service can cause a Denial of Service (DoS) by submitting a held print job targeted at a temporary printer that is subsequently deleted. Because the print scheduler fails to verify that the printer destination still exists before checking the job status, it accesses invalid memory and crashes the cupsd daemon, interrupting all managed print queues.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.1 · 5.1CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-476 · NULL Pointer Dereference