DEBIAN-CVE-2026-41079

See a problem?
Please try reporting it to the source first.
Source
https://security-tracker.debian.org/tracker/CVE-2026-41079
Import Source
https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2026-41079.json
JSON Data
https://api.test.osv.dev/v1/vulns/DEBIAN-CVE-2026-41079
Upstream
Published
2026-04-24T17:16:21.340Z
Modified
2026-05-15T05:00:08.112713699Z
Severity
  • 5.4 (Medium) CVSS_V3 - CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L CVSS Calculator
Summary
[none]
Details

OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.17, a network-adjacent attacker can send a crafted SNMP response to the CUPS SNMP backend that causes an out-of-bounds read of up to 176 bytes past a stack buffer. The leaked memory is converted from UTF-16 to UTF-8 and stored as printer supply description strings, which are subsequently visible to authenticated users via IPP Get-Printer-Attributes responses and the CUPS web interface. This vulnerability is fixed in 2.4.17.

References

Affected packages

Debian:11 / cups

Package

Name
cups
Purl
pkg:deb/debian/cups?arch=source&distro=bullseye

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

2.*
2.3.3op2-3+deb11u1
2.3.3op2-3+deb11u2
2.3.3op2-3+deb11u3
2.3.3op2-3+deb11u4
2.3.3op2-3+deb11u5
2.3.3op2-3+deb11u6
2.3.3op2-3+deb11u7
2.3.3op2-3+deb11u8
2.3.3op2-3+deb11u9
2.3.3op2-3+deb11u10
2.3.3op2-4
2.3.3op2-5
2.3.3op2-6
2.3.3op2-7
2.4.1op1-1
2.4.1op1-2
2.4.2-1
2.4.2-2
2.4.2-3
2.4.2-4
2.4.2-5
2.4.2-6
2.4.7-1
2.4.7-1.1
2.4.7-1.2
2.4.7-2
2.4.7-3
2.4.10-1
2.4.10-2
2.4.10-3
2.4.10-4
2.4.14-1
2.4.15-1
2.4.16-1
2.4.17-1
2.4.18-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2026-41079.json"

Debian:12 / cups

Package

Name
cups
Purl
pkg:deb/debian/cups?arch=source&distro=bookworm

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

2.*
2.4.2-3
2.4.2-3+deb12u1
2.4.2-3+deb12u2
2.4.2-3+deb12u3
2.4.2-3+deb12u4
2.4.2-3+deb12u5
2.4.2-3+deb12u6
2.4.2-3+deb12u7
2.4.2-3+deb12u8
2.4.2-3+deb12u9
2.4.2-4
2.4.2-5
2.4.2-6
2.4.7-1
2.4.7-1.1
2.4.7-1.2
2.4.7-2
2.4.7-3
2.4.10-1
2.4.10-2
2.4.10-3
2.4.10-4
2.4.14-1
2.4.15-1
2.4.16-1
2.4.17-1
2.4.18-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2026-41079.json"

Debian:13 / cups

Package

Name
cups
Purl
pkg:deb/debian/cups?arch=source&distro=trixie

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

2.*
2.4.10-3
2.4.10-3+deb13u1
2.4.10-3+deb13u2
2.4.10-4
2.4.14-1
2.4.15-1
2.4.16-1
2.4.17-1
2.4.18-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2026-41079.json"

Debian:14 / cups

Package

Name
cups
Purl
pkg:deb/debian/cups?arch=source&distro=forky

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.4.17-1

Affected versions

2.*
2.4.10-3
2.4.10-4
2.4.14-1
2.4.15-1
2.4.16-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2026-41079.json"