CVE-2026-39316

Name of the Vulnerable Software and Affected Versions OpenPrinting CUPS versions 2.4.16 and prior

Description OpenPrinting CUPS is a printing system for Linux and Unix-like systems. A use-after-free issue exists in the CUPS scheduler (cupsd) when temporary printers are automatically removed. The cupsdDeleteTemporaryPrinters() function in scheduler/printers.c calls cupsdDeletePrinter() without first expiring subscriptions referencing the printer, resulting in a dangling pointer (cupsd subscription t.dest) to freed memory. Dereferencing this pointer at various code locations can cause the cupsd daemon to crash, leading to a denial of service. Heap grooming could potentially lead to code execution.

Recommendations Update OpenPrinting CUPS to a version later than 2.4.16.