# CVE-2026-107888: OpenPrinting CUPS NULL pointer dereference in cupsdCheckJobs

Source: https://junglewise.ai/threats/cve-2026-107888-openprinting-cups-before-2-4-20-contains-a-null-pointer  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-09. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-107888 · Severity: medium · CVSS 5.1 · Published 2026-10-09

OpenPrinting CUPS is the print server that manages printer queues and job scheduling on Linux systems. A NULL pointer crash occurs when a print job held on creation refers to a temporary printer that has been automatically deleted, causing the entire cupsd scheduler to terminate and interrupt all queues. Under certain configurations, an unprivileged user can trigger this denial of service.

Technologies: [OpenPrinting Cups](https://junglewise.ai/threats/technologies/cups). Vendors: [OpenPrinting](https://junglewise.ai/threats/vendors/openprinting).

## Quick answers

**Is CVE-2026-107888 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-107888 being exploited in the wild.

**How severe is CVE-2026-107888?** Medium severity, with a CVSS score of 5.1, published 9 October 2026.

**Which products and versions are affected?** OpenPrinting Cups 2.4.19 and earlier (vulnerable in 2.2.0–2.4.19).

**Is there a fix for CVE-2026-107888?** Yes: fixed in 2.4.20. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-107888 attacked?** It is attacked with local access, in a hosted service.

**Am I affected by CVE-2026-107888?** Check whether you run OpenPrinting Cups at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 2.4.20

## Technical details

The vulnerability is a NULL pointer dereference in cupsdCheckJobs() at scheduler/job.c:333, triggered when processing a job with "job-held-on-create" reason that references a temporary printer deleted by cupsdDeleteTemporaryPrinters(). The scheduler does not cancel jobs before removing temporary printers and fails to check whether cupsdFindDest() returns NULL. Exploitation requires a temporary printer configured with hold-new-jobs enabled and a held job remaining after printer deletion; the fix checks for NULL and properly handles orphaned jobs.

## Affected products

- OpenPrinting CUPS 2.4.19 and earlier (vulnerable in 2.2.0–2.4.19)

## Timeline

- 2026-10-01: disclosed: GitHub security advisory GHSA-qqm8-4q5h-jg55 published
- 2026-10-09: advisory: NVD entry created for CVE-2026-107888
- 2026-10-01: patched: Fixed in CUPS 2.4.20

## References

- [https://github.com/OpenPrinting/cups/security/advisories/GHSA-qqm8-4q5h-jg55](https://github.com/OpenPrinting/cups/security/advisories/GHSA-qqm8-4q5h-jg55)

## Related threats

- [OpenPrinting CUPS path traversal in banner processing](https://junglewise.ai/threats/cve-2026-61702-openprinting-cups-is-an-open-source-printing-system-for-linux-and)
- [OpenPrinting CUPS symlink-based file truncation in scheduler](https://junglewise.ai/threats/cve-2026-55480-openprinting-cups-is-an-open-source-printing-system-for-linux-and)
- [CUPS null pointer dereference in IPP job ticket handling](https://junglewise.ai/threats/cve-2026-107655-a-flaw-was-found-in-cups-when-processing-embedded-job-ticket)
- [CUPS scheduler case-insensitive username comparison in ACL validation](https://junglewise.ai/threats/cve-2026-87876-cups-scheduler-case-insensitive-username-comparison-in-acl)
- [OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.17…](https://junglewise.ai/threats/cve-2026-41079-openprinting-cups-is-an-open-source-printing-system-for-linux-and)