cups security update (CVE-2025-55480)

CUPS versions prior to 2.4.0-25.oe2203sp4 contain several security flaws. CVE-2025-55480 describes an arbitrary file write vulnerability where the scheduler running as root writes driver-generated PPD files to predictable temporary file paths without safe flags, allowing an lp-group process to create symlinks that lead to root-owned file overwrites. CVE-2026-105326 is an argument injection flaw in the email notification feature where crafted mailto URIs can inject command-line options into sendmail, potentially leading to command execution with CUPS service privileges. CVE-2026-107655 and CVE-2026-107890 describe null pointer dereferences triggered by crafted IPP requests causing denial of service. CVE-2026-107885 is a resource exhaustion vulnerability allowing accumulation of incomplete jobs to exhaust MaxJobs. CVE-2026-107886 is a double-free in printer-class management causing scheduler-wide denial of service. CVE-2026-107888 is another null pointer dereference triggered by job-held-on-create referencing deleted temporary printers. These vulnerabilities collectively impact system availability, integrity, and potentially allow privilege escalation. A patch is available to address these issues.

Successful exploitation of these vulnerabilities can lead to arbitrary file writes with root privileges, command execution as the CUPS service user, denial of service through service crashes or resource exhaustion, and scheduler-wide denial of service. The arbitrary file write vulnerability allows an attacker with lp group privileges to overwrite root-owned files. The command injection vulnerability requires network access to the CUPS service and can lead to execution of attacker-controlled commands. Denial of service vulnerabilities can disrupt printing services, affecting availability. The resource exhaustion vulnerability can prevent legitimate print jobs from being processed.

A security update addressing these vulnerabilities is available and should be applied promptly. The vendor has released patches fixing these issues in versions 2.4.0-25.oe2203sp4 and later. Users should upgrade to the fixed versions to mitigate these risks. No alternative mitigations or workarounds are specified in the advisory.