CVE-2026-55453

Name of the Vulnerable Software and Affected Versions OpenPrinting CUPS versions prior to 2.4.20

Description The quote string() function in backend/ipp.c fails to properly handle carriage-return and line-feed characters within a remote printer-controlled marker-message before the report attr() function writes the value to the scheduler status stream. This allows the scheduler to interpret an injected newline as a separate PPD: control line, enabling the persistence of an attacker-selected PPD keyword. This can lead to remote code execution in the filter context as the lp user, for example, by injecting a FoomaticRIPCommandLine value that is subsequently consumed by a print job on a Foomatic-backed queue.

Recommendations Update to version 2.4.20.