CVE-2026-39316 CUPS has a use-after-free in `cupsdDeleteTemporaryPrinters` via dangling subscription pointer
A use-after-free in CUPS allows attackers to crash the daemon or potentially execute code via heap grooming.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-39316?
CVE-2026-39316 is a medium-severity use after free vulnerability in OpenPrinting cups, published on 7 Apr 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.16 and prior, a use-after-free vulnerability exists in the CUPS scheduler (cupsd) when temporary printers are automatically deleted. cupsdDeleteTemporaryPrinters() in scheduler/printers.c calls cupsdDeletePrinter() without first expiring subscriptions that reference the printer, leaving cupsd_subscription_t.dest as a dangling pointer to freed heap memory. The dangling pointer is subsequently dereferenced at multiple code sites, causing a crash (denial of service) of the cupsd daemon. With heap grooming, this can be leveraged for code execution.
Weakness: CWE-416
Which versions are affected by CVE-2026-39316?
It affects 1 product.
Products include Openprinting Cups.
How do I fix CVE-2026-39316?
Upgrade to a fixed version.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2026-39316 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-39316 exists.
Other vulnerabilities in OpenPrinting cups
- CVE-2025-58060 cups has Authentication bypass with AuthType Negotiate
- CVE-2026-34978 Path traversal in cups
- CVE-2025-58364 cups: Remote DoS via null dereference
- CVE-2026-34980 OpenPrinting CUPS: Shared PostScript queue lets anonymous Print-Job requests reach `lp` code execution over the network
- CVE-2025-61915 OpenPrinting CUPS vulnerable to stack based out-of-bound write
Sources
Also known as ALPINE-CVE-2026-39316, AZL-81935, BELL-CVE-2026-39316, DEBIAN-CVE-2026-39316, ECHO-2ca9-f843-b23e, GHSA-pjv5-prqp-46rg and 3 more.