Is CVE-2026-55480 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-55480 being exploited in the wild.

How severe is CVE-2026-55480?

Medium severity, with a CVSS score of 5.7, published 15 October 2026.

Which products and versions are affected?

OpenPrinting Cups before 2.4.20.

Is there a fix for CVE-2026-55480?

Yes: fixed in 2.4.20. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-55480 attacked?

It is attacked with local access.

Am I affected by CVE-2026-55480?

Check whether you run OpenPrinting Cups at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-55480: OpenPrinting CUPS symlink-based file truncation in scheduler

CVE-2026-55480 · Severity: medium · CVSS 5.7 · Published 2026-10-15

CUPS is an open-source printing system used on Linux and Unix-like systems. A race condition in the printer scheduling code allows an attacker with local access to predict where temporary files are created, plant a symbolic link, and trick the scheduler running as root into overwriting arbitrary files on the system, potentially compromising critical system files or printer functionality.

Technologies: OpenPrinting Cups. Vendors: OpenPrinting.

Quick answers

Is CVE-2026-55480 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-55480 being exploited in the wild.
How severe is CVE-2026-55480?: Medium severity, with a CVSS score of 5.7, published 15 October 2026.
Which products and versions are affected?: OpenPrinting Cups before 2.4.20.
Is there a fix for CVE-2026-55480?: Yes: fixed in 2.4.20. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-55480 attacked?: It is attacked with local access.
Am I affected by CVE-2026-55480?: Check whether you run OpenPrinting Cups at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 2.4.20

Technical details

The copy_model() function in scheduler/ipp.c creates temporary PPD files in a predictable path (TempDir/<connection-number>.ppd) in a group-writable directory and opens them without O_EXCL or O_NOFOLLOW flags. An attacker with lp group membership can win a race condition by creating a symlink at that predictable path before root opens it, causing the scheduler to follow the symlink and truncate or overwrite an arbitrary file. The attack requires both an existing lp-group foothold and a privileged add-printer or modify-printer operation using a model PPD.

Affected products

OpenPrinting CUPS before 2.4.20

Timeline

2026-10-15: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.