Executive brief
CUPS is open-source printing software used by many Linux systems to manage printers and print jobs. A vulnerability in the UTF-32 to UTF-8 character conversion function allows an attacker to read beyond allocated memory boundaries, potentially exposing sensitive data or causing the print service to crash when processing malformed SNMP printer supply information.
Technical details
The cupsUTF32ToUTF8() function in cups/transcode.c lacks proper source buffer length validation, allowing an out-of-bounds read when converting UTF-32 encoded strings. The vulnerability is reachable via SNMP supply-description parsing in backend/snmp-supplies.c, which processes attacker-controlled content from network SNMP responses. An attacker sending a crafted SNMP supply description can trigger the read past the buffer boundary. This is a heap out-of-bounds read that does not directly enable code execution but can leak memory contents or cause a denial-of-service crash. Patches addressing the source-length bound check should be available from the CUPS project.
Affected products
- CUPS CUPS
Timeline
- 2026-09-09: disclosed