# CVE-2026-87875: CUPS cupsUTF32ToUTF8 heap out-of-bounds read in transcode

Source: https://junglewise.ai/threats/cve-2026-87875-cups-cupsutf32toutf8-heap-out-of-bounds-read-in-transcode  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-09. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-87875 · Severity: medium · CVSS 4.3 · Published 2026-09-09

CUPS is open-source printing software used by many Linux systems to manage printers and print jobs. A vulnerability in the UTF-32 to UTF-8 character conversion function allows an attacker to read beyond allocated memory boundaries, potentially exposing sensitive data or causing the print service to crash when processing malformed SNMP printer supply information.

## Quick answers

**Is CVE-2026-87875 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-87875 being exploited in the wild.

**How severe is CVE-2026-87875?** Medium severity, with a CVSS score of 4.3, published 9 September 2026.

**Which products and versions are affected?** CUPS CUPS.

**Is there a fix for CVE-2026-87875?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-87875 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-87875?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The cupsUTF32ToUTF8() function in cups/transcode.c lacks proper source buffer length validation, allowing an out-of-bounds read when converting UTF-32 encoded strings. The vulnerability is reachable via SNMP supply-description parsing in backend/snmp-supplies.c, which processes attacker-controlled content from network SNMP responses. An attacker sending a crafted SNMP supply description can trigger the read past the buffer boundary. This is a heap out-of-bounds read that does not directly enable code execution but can leak memory contents or cause a denial-of-service crash. Patches addressing the source-length bound check should be available from the CUPS project.

## Affected products

- CUPS CUPS

## Timeline

- 2026-09-09: disclosed

## References

- [https://catalog.redhat.com/software/containers/](https://catalog.redhat.com/software/containers/)
- [https://access.redhat.com/downloads/content/package-browser/](https://access.redhat.com/downloads/content/package-browser/)