CVE-2026-107890: CWE-476: NULL Pointer Dereference in OpenPrinting CUPS

OpenPrinting CUPS before version 2.4.20 contains a NULL pointer dereference triggered by repeated IPP group tags in job-creation requests. The IPP parsing process creates unnamed separator attributes with IPP_TAG_ZERO, which add_job() converts to IPP_TAG_JOB. During job startup, functions get_options() and ipp_length() call strlen() on a NULL attribute name, causing the cupsd process to terminate and disrupting all print queues. Exploitation requires the ability to submit a crafted Print-Job request to an accepting and enabled queue supporting the submitted document format. Anonymous submission is possible if permitted by the listener and access-control configuration.

Successful exploitation causes the cupsd daemon to crash, resulting in denial of service by disrupting all print queues. There is no impact on confidentiality or integrity. The CVSS score is 3.3 (low severity), reflecting the limited impact and required local or network-level access with low privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, restrict access to the print scheduler to trusted users and networks, and review listener and access-control configurations to prevent anonymous submissions where possible.