OpenPrinting CUPS, an open source printing system for Linux and Unix-like OSes, has a vulnerability in versions before 2.4.17. A crafted SNMP response sent by a network-adjacent attacker triggers an out-of-bounds read of up to 176 bytes beyond a stack buffer. The leaked memory is converted from UTF-16 to UTF-8 and stored as printer supply description strings, which authenticated users can view through IPP Get-Printer-Attributes responses and the CUPS web interface. This information disclosure vulnerability is resolved in version 2.4.17.

The vulnerability allows an attacker with network adjacency to cause an out-of-bounds read, resulting in information disclosure of memory contents. The leaked data is visible to authenticated users via standard printer attribute queries and the web interface. There is no indication of integrity or availability impact. No known exploits in the wild have been reported.

Upgrade affected CUPS installations to version 2.4.17 or later, where this vulnerability is fixed. Since this is an official fix, applying the update fully mitigates the issue. No additional vendor advisories indicate alternative mitigations or that no action is required.