CVE-2026-87875

The cupsUTF32ToUTF8() function in CUPS's cups/transcode.c lacks a source-length bound and can read past the end of the source buffer, resulting in a heap out-of-bounds read. This is reachable via SNMP supply-description parsing in backend/snmp-supplies.c with attacker-controlled content.

A moderate-impact heap out-of-bounds read was found in the CUPS printing system as shipped in Red Hat Enterprise Linux and other Red Hat products. The cupsUTF32ToUTF8() function in cups/transcode.c does not take a source-length parameter and reads from the source buffer until it encounters a zero word or exhausts its output capacity, so input that lacks a terminating zero word causes the function to read past the end of the buffer. The flaw is reachable through SNMP supply-description parsing in the CUPS SNMP backend (backend/snmp-supplies.c): an attacker on the adjacent network who can control SNMP supply-description content processed by a CUPS server can trigger the out-of-bounds heap read. The consequence is limited to disclosure of adjacent heap memory (low confidentiality impact); there is no impact on integrity or availability. Red Hat's severity matches the upstream CVE record (CVSS 3.1 score 4.3, AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, moderate). The cups package is currently marked affected across Red Hat Enterprise Linux 6, 7, 8, 9, and 10, Red Hat In-Vehicle OS, and Red Hat OpenShift (via RHCOS) streams, and for those streams the fix is deferred; given the moderate rating and the confidentiality-only impact of this adjacent-network out-of-bounds read, the residual risk is limited to possible disclosure of a small amount of heap memory content. For the Fedora and Red Hat Hardened Images (hummingbird) streams the issue is delegated and a fix is being pursued through the responsible maintainers.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Fixed on upstream master branch with commit 0c6842f and for versions 2.4.x with commit 2b1dc17.