cups security update (CVE-2025-55480)

CUPS versions prior to 2.4.7-20.oe2403sp3 contain several security flaws: CVE-2025-55480 allows an lp-group process to exploit predictable temporary file paths without O_EXCL or O_NOFOLLOW flags, enabling arbitrary file overwrite by following symlinks. CVE-2026-105326 involves argument injection in email notification recipient URIs, potentially allowing command execution with CUPS service user privileges. CVE-2026-107655 and CVE-2026-107888 describe null pointer dereferences triggered by crafted IPP requests or job tickets, causing denial of service by crashing the print daemon. CVE-2026-107885 describes a resource exhaustion vulnerability in job submission timeout handling, allowing denial of service by exhausting MaxJobs. CVE-2026-107886 is a double-free vulnerability in printer-class management that can cause scheduler-wide denial of service. These issues collectively impact the stability and security of the CUPS scheduler and printing services.

Successful exploitation can lead to arbitrary file overwrite with root privileges, command execution as the CUPS service user, denial of service by crashing the print scheduler, and denial of service by exhausting print job submission capacity. The vulnerabilities affect the availability, integrity, and potentially confidentiality of the printing system. Exploitation requires network access to the CUPS service and, in some cases, specific configurations such as email notifications or job submission permissions.

A security update is available that addresses these vulnerabilities. Users should apply the official patch or upgrade to a fixed version as soon as possible. No additional mitigations are explicitly required if the update is applied. Until patched, restricting network access to the CUPS service and disabling email notifications or printer subscription features may reduce exposure.