cups security update (CVE-2025-55480)

CUPS versions prior to 2.4.7-18.oe2403sp1 contain multiple security flaws: (1) An arbitrary file write vulnerability (CVE-2025-55480) arises because the cupsd scheduler writes driver-generated PPD files to predictable temporary file paths without safe flags, allowing lp-group processes to create symlinks that root follows, enabling arbitrary root file overwrite. (2) A command injection vulnerability (CVE-2026-105326) exists in the email notification feature where crafted mailto URIs can inject command-line options into sendmail, potentially executing commands with CUPS service user privileges. (3) Several denial-of-service vulnerabilities (CVE-2026-107655, CVE-2026-107885, CVE-2026-107886, CVE-2026-107888, CVE-2026-107890) involve null pointer dereferences, double-free bugs, and resource exhaustion caused by malformed IPP requests or job handling logic, leading to scheduler crashes or print service disruption. These vulnerabilities require network access to the CUPS service and depend on configuration and privilege levels.

Successful exploitation of these vulnerabilities can lead to arbitrary file overwrite with root privileges, command execution as the CUPS service user, and denial of service by crashing the print scheduler or exhausting job submission resources. The arbitrary file write vulnerability allows privilege escalation from lp group to root. The command injection depends on the mail transfer agent and network exposure of CUPS. Denial of service vulnerabilities can disrupt all printing services managed by the affected CUPS instance.

A security update addressing these vulnerabilities is available and should be applied promptly. The vendor has released patches fixing the arbitrary file write, command injection, denial of service, and resource exhaustion issues. Users should upgrade to a fixed version at or beyond 2.4.7-18.oe2403sp1. No additional mitigations are specified beyond applying the official fix.