OpenPrinting CUPS before version 2.4.17 contains an out-of-bounds read vulnerability (CWE-125) in its SNMP backend. A network-adjacent attacker can send a specially crafted SNMP response that causes the software to read up to 176 bytes beyond a stack buffer. The leaked memory is converted from UTF-16 to UTF-8 and stored as printer supply description strings. These strings are then accessible to authenticated users via IPP Get-Printer-Attributes responses and the CUPS web interface, leading to information disclosure (CWE-200). The vulnerability has a CVSS 3.1 base score of 4.3, indicating medium severity. The issue is fixed in CUPS version 2.4.17.

The vulnerability allows an attacker with network adjacency to cause an out-of-bounds read, leaking up to 176 bytes of memory from the stack. This leaked data is exposed as printer supply description strings visible to authenticated users. The impact is limited to confidentiality loss of potentially sensitive memory contents. There is no impact on integrity or availability. No known exploits are reported in the wild.

Upgrade OpenPrinting CUPS to version 2.4.17 or later, where this vulnerability is fixed. Since the vendor advisory confirms the fix in 2.4.17, applying this official update fully mitigates the issue. No other mitigations are indicated or required.