Junglewise Threat Intelligence

CVE-2026-87875: CUPS cupsUTF32ToUTF8 heap out-of-bounds read in transcode

CVE-2026-87875 · Severity: medium · CVSS 4.3 · Published 2026-09-09

Technologies: Cups.

Executive brief

CUPS is open-source printing software used by many Linux systems to manage printers and print jobs. A vulnerability in the UTF-32 to UTF-8 character conversion function allows an attacker to read beyond allocated memory boundaries, potentially exposing sensitive data or causing the print service to crash when processing malformed SNMP printer supply information.

Technical details

The cupsUTF32ToUTF8() function in cups/transcode.c lacks proper source buffer length validation, allowing an out-of-bounds read when converting UTF-32 encoded strings. The vulnerability is reachable via SNMP supply-description parsing in backend/snmp-supplies.c, which processes attacker-controlled content from network SNMP responses. An attacker sending a crafted SNMP supply description can trigger the read past the buffer boundary. This is a heap out-of-bounds read that does not directly enable code execution but can leak memory contents or cause a denial-of-service crash. Patches addressing the source-length bound check should be available from the CUPS project.

Affected products

  • CUPS CUPS

Timeline

  • 2026-09-09: disclosed

References