CVE-2026-55480

Name of the Vulnerable Software and Affected Versions OpenPrinting CUPS versions prior to 2.4.20

Description The copy model() function in scheduler/ipp.c creates a predictable file path in a directory writable by the lp-group. Because the file is opened as root without using O EXCL or O NOFOLLOW flags, a local attacker with lp-group permissions can predict the connection-derived name and create a symbolic link. When a privileged operation, such as adding or modifying a printer using a model PPD, triggers the copy model() function, the root scheduler may follow the symbolic link. This allows the attacker to truncate or overwrite files that are only writable by root, leading to a compromise of file integrity or availability.

Recommendations Update to version 2.4.20.