{"id":"DEBIAN-CVE-2026-34990","details":"OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.16 and prior, a local unprivileged user can coerce cupsd into authenticating to an attacker-controlled localhost IPP service with a reusable Authorization: Local ... token. That token is enough to drive /admin/ requests on localhost, and the attacker can combine CUPS-Create-Local-Printer with printer-is-shared=true to persist a file:///... queue even though the normal FileDevice policy rejects such URIs. Printing to that queue gives an arbitrary root file overwrite; the PoC below uses that primitive to drop a sudoers fragment and demonstrate root command execution. At time of publication, there are no publicly available patches.","modified":"2026-09-29T11:02:58.518999789Z","published":"2026-04-03T22:16:27.400Z","upstream":["CVE-2026-34990"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2026-34990"}],"affected":[{"package":{"name":"cups","ecosystem":"Debian:12","purl":"pkg:deb/debian/cups?arch=source&distro=bookworm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.10-1","2.4.10-2","2.4.10-3","2.4.10-4","2.4.14-1","2.4.15-1","2.4.16-1","2.4.17-1","2.4.18-1","2.4.2-3","2.4.2-3+deb12u1","2.4.2-3+deb12u2","2.4.2-3+deb12u3","2.4.2-3+deb12u4","2.4.2-3+deb12u5","2.4.2-3+deb12u6","2.4.2-3+deb12u7","2.4.2-3+deb12u8","2.4.2-3+deb12u9","2.4.2-4","2.4.2-5","2.4.2-6","2.4.7-1","2.4.7-1.1","2.4.7-1.2","2.4.7-2","2.4.7-3"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2026-34990.json"}},{"package":{"name":"cups","ecosystem":"Debian:13","purl":"pkg:deb/debian/cups?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.10-3","2.4.10-3+deb13u1","2.4.10-3+deb13u2","2.4.10-4","2.4.14-1","2.4.15-1","2.4.16-1","2.4.17-1","2.4.18-1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2026-34990.json"}},{"package":{"name":"cups","ecosystem":"Debian:14","purl":"pkg:deb/debian/cups?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.17-1"}]}],"versions":["2.4.10-3","2.4.10-4","2.4.14-1","2.4.15-1","2.4.16-1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2026-34990.json"}}],"schema_version":"1.9.0"}