CVE-2026-87875 Cups: openprinting cups: heap out-of-bounds read in cupsutf32toutf8() via missing source-length bound
An attacker can trigger a heap out-of-bounds read in CUPS via SNMP supply parsing, potentially causing crashes or leaking memory.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-87875?
CVE-2026-87875 is a medium-severity memory corruption vulnerability in Red Hat Enterprise Linux 10, published on 9 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
The cupsUTF32ToUTF8() function in CUPS's cups/transcode.c lacks a source-length bound and can read past the end of the source buffer, resulting in a heap out-of-bounds read. This is reachable via SNMP supply-description parsing in backend/snmp-supplies.c with attacker-controlled content.
Weakness: CWE-125
Which versions are affected by CVE-2026-87875?
Linux distribution packages (19)
cups Red Hat:hummingbird:1 | All versions | 0:2.4.19-4.1.hum1 |
cups-client Red Hat:hummingbird:1 | All versions | 0:2.4.19-4.1.hum1 |
cups-devel Red Hat:hummingbird:1 | All versions | 0:2.4.19-4.1.hum1 |
cups-filesystem Red Hat:hummingbird:1 | All versions | 0:2.4.19-4.1.hum1 |
cups-ipptool Red Hat:hummingbird:1 | All versions | 0:2.4.19-4.1.hum1 |
cups-libs Red Hat:hummingbird:1 | All versions | 0:2.4.19-4.1.hum1 |
cups-lpd Red Hat:hummingbird:1 | All versions | 0:2.4.19-4.1.hum1 |
cups-printerapp Red Hat:hummingbird:1 | All versions | 0:2.4.19-4.1.hum1 |
cups SUSE:Linux Enterprise Micro 5.3 | All versions | 2.2.7-150000.3.96.1 |
cups SUSE:Linux Enterprise Micro 5.4 | All versions | 2.2.7-150000.3.96.1 |
cups SUSE:Linux Enterprise Micro 5.5 | All versions | 2.2.7-150000.3.96.1 |
cups SUSE:Linux Enterprise Module for Basesystem 15 SP7 | All versions | 2.2.7-150000.3.96.1 |
cups SUSE:Linux Enterprise Module for Desktop Applications 15 SP7 | All versions | 2.2.7-150000.3.96.1 |
cups SUSE:Linux Enterprise Module for Development Tools 15 SP7 | All versions | 2.2.7-150000.3.96.1 |
cups SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 | All versions | 1.7.5-20.70.1 |
cups SUSE:Linux Micro 6.0 | All versions | 2.4.19-2.1 |
cups SUSE:Linux Micro 6.1 | All versions | 2.4.19-slfo.1.1_2.1 |
cups openSUSE:Leap 16.0 | All versions | 2.4.19-160000.2.1 |
cups openSUSE:Tumbleweed | All versions | 2.4.19-3.1 |
How do I fix CVE-2026-87875?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-87875 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-87875 exists.
Sources
Also known as AZL-100920, BELL-CVE-2026-87875, DEBIAN-CVE-2026-87875, ECHO-95b0-8ee7-7f63, GHSA-559w-7676-3xrq, RHSA-2026:66600 and 7 more.