CVE-2026-34980: 
Rocky Linux vulnerability analysis and mitigation

CVE-2026-34980 is a PPD injection / OS command injection vulnerability in OpenPrinting CUPS that allows an unauthenticated network attacker to achieve remote code execution as the lp user on systems running a network-exposed cupsd with a shared PostScript queue. It affects OpenPrinting CUPS versions 2.4.16 and prior, and was published on April 3, 2026. The patched version is CUPS 2.4.17, released in April 2026. It carries a CVSS v3.1 base score of 7.5 (High) and a CVSS v4.0 base score of 6.1 (Medium) (GitHub Advisory, Red Hat Bugzilla).

The root cause is improper input validation (CWE-20) combined with OS command injection (CWE-78) in the handling of IPP job attributes. When a Print-Job request is submitted to a shared PostScript queue, the scheduler serializes attacker-controlled job attributes — specifically the page-border value supplied as textWithoutLanguage — into a filter options string, escaping embedded newlines with backslashes. During reparsing, cups/options.c removes those backslashes, preserving the embedded newline, so the second line beginning with PPD: reaches scheduler/statbuf.c, which treats it as a trusted scheduler control record. The injected cupsFilter2 directive is then written into the queue's PPD file; a subsequent raw print job causes the scheduler to invoke the attacker-specified binary (e.g., /usr/bin/vim) as the lp user. A full PoC Python script demonstrating the three-stage attack (baseline, poison, trigger) is publicly available in the GitHub Security Advisory (GitHub Advisory).

Successful exploitation grants an unauthenticated remote attacker code execution with the privileges of the CUPS lp process on the affected server. When chained with related CUPS vulnerabilities (GHSA-c54j-2vqw-wpwp or GHSA-625v-6g8p-wm8p), the attack chain can escalate to root-level file overwrite, effectively providing full system compromise on typical Linux deployments. Confidentiality, integrity, and availability of the CUPS server are all highly impacted, with potential for lateral movement from the print server to other networked systems (GitHub Advisory, Linux Security).

A complete, runnable Python PoC exploit script is publicly available in the GitHub Security Advisory, demonstrating unauthenticated RCE via PPD injection and filter manipulation. Exploitation has been reported by multiple sources including linuxsecurity.com, and the vulnerability has received coverage from The Register noting it was discovered by an AI agent pipeline. The EPSS score is approximately 0.038% (0.000380), indicating currently low automated exploitation probability, and it does not appear in the CISA KEV catalog as of the time of this report. Detection plugins are available in Nessus (IDs: 310230, 311214, 311327, 317701, 319997) and Qualys (IDs: 288565, 917890) (GitHub Advisory, Linux Security).

1. Reconnaissance: Identify network-exposed CUPS servers (port 631/TCP) running versions ≤ 2.4.16 with a shared PostScript queue using tools like Shodan, Censys, or nmap (nmap -p 631 --script ipp-discover).
2. Verify shared queue: Query the target cupsd via IPP to enumerate shared printer queues that use a PostScript/PPD path (e.g., Get-Printers IPP request).
3. Poison stage — inject malicious PPD directive: Send a crafted IPP Print-Job request to the shared PostScript queue with a page-border attribute containing an embedded newline followed by a PPD: cupsFilter2 directive, e.g., page_border='bad\nPPD: cupsFilter2="application/vnd.cups-raw application/octet-stream -100 /usr/bin/vim"\nX'. The scheduler serializes this into the filter options string, and upon reparsing, the embedded newline causes the PPD: line to be treated as a trusted scheduler control record, writing the injected cupsFilter2 entry into the queue's PPD file.
4. Verify PPD poisoning: Read the queue PPD file (e.g., /etc/cups/ppd/<queue>.ppd) to confirm the injected *cupsFilter2 line is present.
5. Trigger stage — achieve code execution: Send a follow-up raw print job (document-format: application/vnd.cups-raw) to the same queue. The scheduler now invokes the attacker-specified binary (/usr/bin/vim) as the lp user, with job-name and user-name fields passed as arguments, enabling arbitrary command execution (e.g., via vim's -c flag to run shell commands).
6. Escalate (optional): Chain with GHSA-c54j-2vqw-wpwp or GHSA-625v-6g8p-wm8p to escalate from lp to root-level file overwrite (GitHub Advisory).

• Network: Unexpected IPP Print-Job POST requests to /printers/<queue> on port 631 from unauthorized or external IP addresses; raw print jobs (application/vnd.cups-raw) submitted immediately after PostScript jobs from the same source.
• Logs: CUPS error log (/var/log/cups/error_log) entries containing page-border values with embedded newlines or PPD: cupsFilter2 strings, e.g., cupsdProcessIPPRequest: page-border textWithoutLanguage 'bad\nPPD: cupsFilter2=...'; log lines showing Started filter /usr/bin/vim or other unexpected binaries.
• File System: Unexpected *cupsFilter2 directives in queue PPD files (e.g., /etc/cups/ppd/<queue>.ppd) pointing to system binaries like /usr/bin/vim; unexpected files created in /var/spool/cups/tmp/ by the lp user.
• Process: Unusual child processes spawned by cupsd that are not standard CUPS filters (e.g., vim, bash, python, curl); processes running as lp (uid=4) executing system commands or writing to unexpected file paths (GitHub Advisory).

Upgrade OpenPrinting CUPS to version 2.4.17 or later, which filters out control characters from option values (commits 399ad15 on master and 8d0f51c on the 2.4.x branch) (OpenPrinting Release). Distribution-specific patches are available for Red Hat, SUSE (SUSE-SU-202621787-1), Ubuntu (USN-8405-1), Amazon Linux 2 (ALAS2-2026-3279), Amazon Linux 2023 (ALAS2023-2026-1635), Slackware, Fedora, and openSUSE. If immediate patching is not possible, apply firewall rules to restrict access to port 631 to trusted networks only, disable printer sharing (printer-is-shared=false) in cupsd.conf, and consider disabling the cupsd network listener entirely if remote printing is not required (Red Hat Bugzilla, GitHub Advisory).

The vulnerability received notable media coverage from The Register, which highlighted that it was discovered by an AI agent pipeline — an unusual disclosure detail that drew significant community interest (The Register). The Canadian Centre for Cyber Security issued a security advisory (AV26-326), and CERT.at flagged it in their daily reports. Security researchers on Reddit's r/netsec discussed the "spooler alert" RCE-to-root chain, drawing comparisons to the 2024 CUPS vulnerability cluster. GBHackers, CyberPress, and CyberSecurityNews covered the root-level code execution potential, while the grugq newsletter and TLDR InfoSec included it in weekly security roundups. The researcher credited with discovery, Asim Viladi Oglu Manizada (@manizada), disclosed use of a custom AI agent pipeline for vulnerability discovery, which itself became a topic of discussion in the security community (GitHub Advisory, The Register).