cups security update (CVE-2025-55480)

CUPS versions prior to 2.4.7-20.oe2403sp4 contain several vulnerabilities: CVE-2025-55480 involves a predictable temporary file path used by the root-privileged scheduler, allowing an lp-group process to create a symlink that leads to arbitrary file overwrite with root privileges. CVE-2026-105326 is an argument injection flaw in the email notification feature where crafted mailto URIs can influence sendmail command-line options, potentially allowing command execution with CUPS service user privileges. CVE-2026-107655 describes a null pointer dereference triggered by malformed IPP attributes causing a denial of service. CVE-2026-107885 is a resource exhaustion vulnerability where incomplete jobs can accumulate and exhaust the job queue. CVE-2026-107886 is a double-free vulnerability in printer-class management leading to denial of service. CVE-2026-107888 and CVE-2026-107890 are null pointer dereferences triggered by specific job conditions and malformed IPP group tags, respectively, causing scheduler crashes and service disruption. These issues are addressed in patched versions.

Successful exploitation can lead to arbitrary file overwrite with root privileges, command execution with CUPS service user privileges, denial of service through scheduler crashes or resource exhaustion, and disruption of printing services. The vulnerabilities affect system stability and security, potentially allowing local privilege escalation or remote denial of service depending on network exposure and configuration.

A patch is available for these vulnerabilities. Users should upgrade CUPS to version 2.4.7-20.oe2403sp4 or later to remediate these issues. Until patched, restricting network access to the CUPS service and disabling email notifications can reduce exposure. No vendor advisory states that no action is required or that the issues are already mitigated without patching.