CVE-2026-55467 CUPS fax option values bypass the CVE-2026-34980 control-character sanitizer (incomplete fix)
An attacker with job submission privileges can inject control characters into fax options, potentially executing code or disrupting queues if vulnerable filters are used.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-55467?
CVE-2026-55467 is a low-severity command injection vulnerability in OpenPrinting cups, published on 15 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, the cupsdCreateJob option-string builder in scheduler/job.c maps attacker-controlled destination-uri and pre-dial-string values from a configured fax queue to the phone and faxPrefix options. Unlike ordinary IPP job attributes, these mapped fax values bypass the control-character sanitizer and are copied directly into the filter options argument. A user permitted to submit a job can therefore inject control characters into the downstream option stream. The reporter states that a downstream fax filter passing these values to a shell or modem command could execute code as lp, while the maintainer states that CUPS has no confidentiality or integrity impact because the only known code-executing filter is optional Foomatic and addressed separately, leaving possible disruption of the affected queue. This issue is fixed in version 2.4.20.
Which versions are affected by CVE-2026-55467?
It affects 1 product.
Products include Openprinting Cups.
How do I fix CVE-2026-55467?
Upgrade to a fixed version.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-55467 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-55467 exists.
Other vulnerabilities in OpenPrinting cups
- CVE-2025-58060 cups has Authentication bypass with AuthType Negotiate
- CVE-2026-34978 Path traversal in cups
- CVE-2025-58364 cups: Remote DoS via null dereference
- CVE-2026-34980 OpenPrinting CUPS: Shared PostScript queue lets anonymous Print-Job requests reach `lp` code execution over the network
- CVE-2025-61915 OpenPrinting CUPS vulnerable to stack based out-of-bound write
Sources
Also known as AZL-108278, BELL-CVE-2026-55467, DEBIAN-CVE-2026-55467, ECHO-f9e9-2edb-85ee, GHSA-69qc-prxg-h2c7, UBUNTU-CVE-2026-55467.