Quick answers
- Is CVE-2026-34979 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-34979 being exploited in the wild.
- How severe is CVE-2026-34979?
- Medium severity, with a CVSS score of 5.3, published 3 April 2026.
- Which products and versions are affected?
- OpenPrinting Cups <= 2.4.16.
- Is there a fix for CVE-2026-34979?
- A patch was published on 2026-04-03: Version 2.4.17 released to address the overflow Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-34979 attacked?
- It is attacked over the network, in an operating system.
- Am I affected by CVE-2026-34979?
- Check whether you run OpenPrinting Cups at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A heap-based buffer overflow exists in the CUPS scheduler (cupsd) within the `get_options()` function in `scheduler/job.c`. The vulnerability is caused by a discrepancy between how `ipp_length()` calculates the required buffer size for job attributes and how the attributes are actually serialized. Specifically, `ipp_length()` skips URI attributes, but `get_options()` still writes certain URI attributes (such as `job-uuid` and `job-authorization-uri`) to the buffer without performing bounds checks. A remote, unauthenticated attacker can exploit this by submitting a print job with maliciously large URI attributes, leading to memory corruption, a service crash (DoS), or potentially arbitrary code execution. The issue is addressed in version 2.4.17.
Affected products
- OpenPrinting CUPS <= 2.4.16
Timeline
- 2026-03-31: advisory: GitHub Security Advisory published by OpenPrinting
- 2026-04-03: disclosed: CVE-2026-34979 published
- 2026-04-03: patched: Version 2.4.17 released to address the overflow