OpenPrinting CUPS versions up to 2.4.16 contain an integer underflow vulnerability (CWE-191) in the _ppdCreateFromIPP() function within cups/ppd-cache.c. The vulnerability arises because the code only caps the upper bound of the job-password-supported IPP attribute but does not check for negative values. When a negative value is supplied, it is cast to an unsigned size_t, resulting in a very large value due to wraparound. This large value is then used as the length argument in a memset() call on a 33-byte stack buffer, causing an immediate segmentation fault (SIGSEGV) and crashing the cupsd root process. Because systemd is configured with Restart=on-failure, the service restarts automatically, allowing an attacker to repeatedly crash the service and cause sustained denial of service. The vulnerability requires local unprivileged user access and does not impact confidentiality or integrity.

An unprivileged local user can cause the cupsd root process to crash repeatedly, resulting in a denial of service. There is no impact on confidentiality or integrity. The vulnerability exploits an integer underflow leading to a large memory operation on a small buffer, causing a segmentation fault. The automatic restart of the service by systemd allows sustained denial of service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch or official fix is available, restrict unprivileged local user access to the printing service or disable the service if not needed to mitigate the risk of denial of service. Monitor vendor channels for updates regarding an official fix.