OpenPrinting CUPS (<= 2.4.16) contains an improper input validation vulnerability (CWE-20) in the network-exposed cupsd service when using a shared target queue. An unauthorized client can submit a Print-Job without authentication. The server accepts a page-border value as textWithoutLanguage, preserves embedded newlines through option escaping and reparsing, and interprets the resulting second-line PPD text as a trusted scheduler control record. This allows a follow-up raw print job to execute an existing binary such as /usr/bin/vim with lp privileges. There is no official patch or remediation available at the time of disclosure.

An attacker with network access to a vulnerable CUPS server can bypass authentication to submit print jobs to a shared PostScript queue. By exploiting improper input validation and parsing of the page-border value, the attacker can cause the server to execute arbitrary existing binaries with the privileges of the print scheduler. This could lead to unauthorized code execution on the affected system. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix is available, organizations should consider restricting network access to the cupsd service, disabling shared target queues if possible, or applying other network-level controls to limit exposure until a patch is released.