CUPS Multiple Vulnerabilities Allow Remote Code Execution

CERT-Bund published advisory WID-SEC-2026-0947 disclosing multiple critical vulnerabilities in Open Source CUPS versions prior to 2.4.17. The flaws carry a CVSS Base Score of 7.6 and allow remote attackers to bypass security measures, execute arbitrary code, obtain elevated privileges, manipulate data, or trigger denial-of-service conditions via exploitation of the Internet Printing Protocol (IPP).\n\nSystem administrators managing UNIX, Windows, or other systems running CUPS should immediately update to version 2.4.17 or later to mitigate remote code execution and privilege escalation risks. If immediate patching is not feasible, consider disabling the IPP port (631) or restricting network access to the print service.