OpenPrinting CUPS (<= 2.4.16) contains an integer underflow vulnerability (CWE-191) in the _ppdCreateFromIPP() function within cups/ppd-cache.c. The vulnerability arises because the bounds check only limits the upper bound of the job-password-supported IPP attribute, allowing negative values to pass. When a negative value is cast to size_t, it wraps to a very large unsigned integer, which is then used as the length parameter in memset() on a 33-byte stack buffer. This causes an immediate segmentation fault (SIGSEGV) in the cupsd process running as root. Due to systemd's Restart=on-failure setting, an attacker can repeatedly crash and restart the service, resulting in sustained denial of service. The vulnerability requires local unprivileged user access and does not impact confidentiality or integrity.

An unprivileged local user can cause the cupsd root process to crash repeatedly, leading to a denial of service condition. There is no impact on confidentiality or integrity. The vulnerability exploits an integer underflow that causes a buffer overwrite attempt triggering a segmentation fault.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, restrict local user access to the CUPS service or disable the service if not required to prevent exploitation. Monitor for updates from the OpenPrinting project regarding an official fix.