CVE-2026-34979 OpenPrinting CUPS: Heap overflow in `get_options()`
A heap-based buffer overflow in the CUPS scheduler allows attackers to execute arbitrary code or cause denial of service via crafted job attributes.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-34979?
CVE-2026-34979 is a medium-severity memory corruption vulnerability in OpenPrinting cups, published on 3 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.16 and prior, there is a heap-based buffer overflow in the CUPS scheduler when building filter option strings from job attribute. At time of publication, there are no publicly available patches.
Weakness: CWE-122
Which versions are affected by CVE-2026-34979?
It affects 1 product.
Products include Openprinting Cups.
How do I fix CVE-2026-34979?
No fix published yet.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-34979 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-34979 exists.
Other vulnerabilities in OpenPrinting cups
- CVE-2025-58060 cups has Authentication bypass with AuthType Negotiate
- CVE-2026-34978 Path traversal in cups
- CVE-2025-58364 cups: Remote DoS via null dereference
- CVE-2026-34980 OpenPrinting CUPS: Shared PostScript queue lets anonymous Print-Job requests reach `lp` code execution over the network
- CVE-2025-61915 OpenPrinting CUPS vulnerable to stack based out-of-bound write
Sources
Also known as ALPINE-CVE-2026-34979, AZL-81813, BELL-CVE-2026-34979, DEBIAN-CVE-2026-34979, ECHO-0478-5c11-f4d3, GHSA-6qxf-7jx6-86fh and 3 more.