Source: cups Version: 2.4.18-1 X-Debbugs-CC: [email protected] Severity: important Tags: security upstream
Hi, The following vulnerability was published for cups. CVE-2026-107886[0]: | OpenPrinting CUPS before 2.4.20 contains a double-free in printer- | class management. When CUPS-Add-Modify-Class replaces an existing | class member list, add_class() frees pclass->printers without | clearing the pointer. If subsequent validation fails, the class | retains the dangling pointer; CUPS-Delete-Class subsequently frees | the same allocation in cupsdDeletePrinter(). A client authorized to | modify and delete classes can cause scheduler-wide denial of | service. The default policy requires @SYSTEM privileges. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-107886 https://www.cve.org/CVERecord?id=CVE-2026-107886 [1] https://github.com/OpenPrinting/cups/security/advisories/GHSA-pwg4-pv39-8c22 [2] https://github.com/OpenPrinting/cups/commit/13bc9d4f8d695403d54469cc3c8b675e34a7037f Please adjust the affected versions in the BTS as needed. Regards, Salvatore
