CVE-2026-55467

Name of the Vulnerable Software and Affected Versions OpenPrinting CUPS versions prior to 2.4.20

Description The cupsdCreateJob option-string builder in scheduler/job.c maps attacker-controlled destination-uri and pre-dial-string values from a configured fax queue to the phone and faxPrefix options. These mapped fax values bypass the control-character sanitizer and are copied directly into the filter options argument, allowing a user permitted to submit a job to inject control characters into the downstream option stream. This could lead to code execution as the lp user if a downstream fax filter passes these values to a shell or modem command, or result in the disruption of the affected queue.

Recommendations Update to version 2.4.20.