CVE-2026-107655

MEDIUM 4.0

Cups: null pointer dereference via embedded job ticket comments allows remote denial of service

CVSS Score

4.0

EPSS Score

0.0%

EPSS Percentile

0th

A flaw was found in CUPS. When processing embedded job ticket comments within documents, the service improperly handles specific IPP attributes, causing an unhandled null pointer dereference. An unauthenticated attacker permitted to submit jobs to a shared printer queue can send a crafted Internet Printing Protocol (IPP) request to crash the print daemon, resulting in a temporary Denial of Service (DoS) for all printing services.

CWE	CWE-476
Vendor	red hat
Product	red hat hardened images
Published	Oct 9, 2026
Last Updated	Oct 9, 2026

Stay Ahead of the Next One

Get instant alerts for red hat red hat hardened images

Be the first to know when new medium vulnerabilities affecting red hat red hat hardened images are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

Affected Versions

Red Hat / Red Hat Hardened Images

All versions affected

References

NVD ↗ CVE.org ↗ EPSS Data ↗

access.redhat.com: https://access.redhat.com/security/cve/CVE-2026-107655 bugzilla.redhat.com: https://bugzilla.redhat.com/show_bug.cgi?id=2548399 github.com: https://github.com/OpenPrinting/cups/commit/12237ad github.com: https://github.com/OpenPrinting/cups/commit/25d6830 github.com: https://github.com/OpenPrinting/cups/security/advisories/GHSA-58wv-9ffm-5w78