CVE-2026-39314 CUPS has an integer underflow in `_ppdCreateFromIPP` causes root cupsd crash via negative `job-password-supported`
An unprivileged local user can crash the root CUPS daemon via an integer underflow, causing sustained denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-39314?
CVE-2026-39314 is a medium-severity vulnerability in OpenPrinting cups, published on 7 Apr 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.16 and prior, an integer underflow vulnerability in _ppdCreateFromIPP() (cups/ppd-cache.c) allows any unprivileged local user to crash the cupsd root process by supplying a negative job-password-supported IPP attribute. The bounds check only caps the upper bound, so a negative value passes validation, is cast to size_t (wrapping to ~2^64), and is used as the length argument to memset() on a 33-byte stack buffer. This causes an immediate SIGSEGV in the cupsd root process. Combined with systemd's Restart=on-failure, an attacker can repeat the crash for sustained denial of service.
Weakness: CWE-191
Which versions are affected by CVE-2026-39314?
It affects 1 product.
Products include Openprinting Cups.
How do I fix CVE-2026-39314?
Upgrade to a fixed version.
Is CVE-2026-39314 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-39314 exists.
Other vulnerabilities in OpenPrinting cups
- CVE-2025-58060 cups has Authentication bypass with AuthType Negotiate
- CVE-2026-34978 Path traversal in cups
- CVE-2025-58364 cups: Remote DoS via null dereference
- CVE-2026-34980 OpenPrinting CUPS: Shared PostScript queue lets anonymous Print-Job requests reach `lp` code execution over the network
- CVE-2025-61915 OpenPrinting CUPS vulnerable to stack based out-of-bound write
Sources
Also known as ALPINE-CVE-2026-39314, AZL-81938, BELL-CVE-2026-39314, DEBIAN-CVE-2026-39314, ECHO-b289-5966-d14f, GHSA-pp8w-2g52-7vj7 and 3 more.