CVE-2026-107890 Null dereference in CUPS

What is CVE-2026-107890?

CVE-2026-107890 is a low-severity vulnerability in OpenPrinting CUPS, published on 9 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

OpenPrinting CUPS before 2.4.20 contains a NULL pointer dereference caused by repeated IPP group tags in job-creation requests. IPP parsing creates unnamed separator attributes with IPP_TAG_ZERO, but add_job() converts these separators to IPP_TAG_JOB. During job startup, get_options()/ipp_length() subsequently calls strlen() on a NULL attribute name, terminating cupsd and disrupting all queues. A single crafted Print-Job request can trigger the crash when the client can reach the scheduler and submit jobs to an accepting, enabled queue supporting the submitted document format. Anonymous submission is possible when permitted by listener and access-control configuration.

Weakness: CWE-476

Which versions are affected by CVE-2026-107890?

It affects 1 product.

Products include Openprinting Cups.

How do I fix CVE-2026-107890?

Upgrade to a fixed version.

Is CVE-2026-107890 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-107890 exists.

Other vulnerabilities in OpenPrinting CUPS

• CVE-2025-58060 cups has Authentication bypass with AuthType Negotiate High 8.0
• CVE-2026-34978 Path traversal in cups Medium 6.5
• CVE-2025-58364 cups: Remote DoS via null dereference Medium 6.5
• CVE-2026-34980 OpenPrinting CUPS: Shared PostScript queue lets anonymous Print-Job requests reach `lp` code execution over the network Medium 6.1
• CVE-2025-61915 OpenPrinting CUPS vulnerable to stack based out-of-bound write Medium 6.0

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• GitHub advisory
• How this page is made

Also known as AZL-106884, BELL-CVE-2026-107890, CLSA-2026-1792166076, DEBIAN-CVE-2026-107890, ECHO-2000-f066-fb3d, GHSA-q6rw-m9p2-pjq2 and 2 more.