CVE-2026-41079: 
Alma Linux vulnerability analysis and mitigation

CVE-2026-41079 is an out-of-bounds read vulnerability in the OpenPrinting CUPS SNMP backend that allows a network-adjacent unauthenticated attacker to leak up to 176 bytes of stack memory, which is subsequently exposed to authenticated users via IPP and the CUPS web interface. It affects all CUPS versions prior to 2.4.17 (i.e., ≤ 2.4.16). The vulnerability was published on April 24, 2026, and fixed in CUPS 2.4.17. It carries a CVSS v3.1 base score of 5.4 (Medium) per Feedly/NVD, though the GitHub advisory scores it 4.3 (Moderate) (GitHub Advisory).

The root cause (CWE-125: Out-of-bounds Read; CWE-200: Exposure of Sensitive Information) lies in cups/snmp.c, function asn1_decode_snmp(). When processing an ASN.1 OCTET_STRING, the num_bytes field of the cups_snmp_string_t struct is set to the raw attacker-controlled ASN.1 length value before asn1_get_string() clamps the actual copy to min(length, 1023) bytes — but num_bytes is never updated to reflect the clamped value. In backend/snmp-supplies.c, backend_walk_cb() then passes this inflated num_bytes to utf16_to_utf8(), which reads up to 176 bytes past the 1024-byte string.bytes buffer into adjacent stack memory (including the num_bytes field itself, struct padding, and stack variables). The leaked bytes are converted from UTF-16 to UTF-8 and stored as printer supply description strings, propagated via cupsd to the printer-supply-description IPP attribute and the CUPS web UI. Exploitation requires the attacker to be on the same LAN segment and respond to CUPS SNMP GetRequest broadcasts with a crafted GetResponse setting prtLocalizationCharacterSet=1015 (UTF-16BE) and an OCTET_STRING with an inflated length field (e.g., 1200) (GitHub Advisory, Patch Commit).

The primary impact is information disclosure: up to 176 bytes of stack memory — potentially containing return addresses, local variables, or pointers — are leaked and made visible to any authenticated CUPS user via IPP Get-Printer-Attributes responses and the CUPS web interface at https://localhost:631/printers/. A secondary availability impact exists in hardened builds (compiled with ASan or run under Valgrind), where the out-of-bounds read can crash the supply monitoring function, constituting a denial-of-service of that component. There is no integrity impact, and the vulnerability does not directly enable remote code execution or lateral movement (GitHub Advisory).

A proof-of-concept exploit is publicly available in the GitHub security advisory, including both a Python SNMP responder (poc_snmp_oob_read.py) and a C program with full ASan crash output (poc_snmp_e2e.c). Exploitation requires no authentication and no user interaction, but the attacker must be on the same LAN segment as the CUPS host and SNMP printer discovery must be enabled (the default configuration). There is no evidence of in-the-wild exploitation as of the time of publication, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is approximately 0.012% (0.000120), reflecting low probability of near-term exploitation (GitHub Advisory, Feedly).

1. Reconnaissance: Identify CUPS hosts on the local network segment that have SNMP printer discovery enabled (default). Use network scanning tools (e.g., nmap -sU -p 161) to find hosts listening on UDP/161 or observe SNMP GetRequest broadcasts from CUPS backends.
2. Set up SNMP listener: Deploy a crafted SNMP responder (e.g., poc_snmp_oob_read.py from the advisory) on the attacker's machine, binding to UDP port 161 and listening for SNMP GetRequest broadcasts from the CUPS SNMP backend.
3. Craft malicious SNMP response: When a CUPS SNMP GetRequest is received, respond with a crafted GetResponse containing:
   • prtLocalizationCharacterSet = 1015 (CUPS_TC_csUTF16BE) to trigger UTF-16 processing
   • prtMarkerSuppliesDescription as an ASN.1 OCTET_STRING with the length field set to 1200 (exceeding the 1024-byte buffer), but only 1023 bytes of actual data
4. Trigger out-of-bounds read: CUPS processes the response, sets num_bytes=1200, copies only 1023 bytes into string.bytes, then calls utf16_to_utf8() with the inflated num_bytes, reading 176 bytes past the buffer into adjacent stack memory.
5. Observe leaked data: The leaked stack bytes are converted to UTF-8 and stored as printer supply description strings. An authenticated user (or the attacker if they have CUPS credentials) can retrieve the leaked data via an IPP Get-Printer-Attributes request or by visiting the CUPS web UI at https://<target>:631/printers/ (GitHub Advisory).

• Network: Unexpected SNMP GetResponse packets (UDP/161) originating from non-printer hosts on the LAN, particularly responses containing unusually large OCTET_STRING length fields (>1024); SNMP traffic from hosts not in the authorized printer inventory.
• Logs: CUPS error log (/var/log/cups/error_log) entries showing unexpected or garbled printer supply description strings for SNMP-discovered printers; repeated SNMP backend activity for printers not physically present.
• File System / Process: Unusual cups-snmp backend process activity; garbled or non-printable characters appearing in printer-supply-description attributes visible via ipptool or the CUPS web UI at https://localhost:631/printers/.
• IPP Attributes: Get-Printer-Attributes responses containing printer-supply-description values with garbled, non-UTF-8-clean, or binary-looking strings for SNMP-discovered printers (GitHub Advisory).

Upgrade OpenPrinting CUPS to version 2.4.17 or later, which clamps num_bytes to the actual buffer size after asn1_get_string() in cups/snmp.c (Patch Commit, Patch Commit master). As a workaround where upgrading is not immediately possible: disable SNMP printer discovery by editing /etc/cups/snmp.conf and setting Address to an empty value or removing SNMP backend entries, and restrict UDP/161 traffic to authorized printer management hosts using firewall rules. Distribution-specific patches are available for SUSE (SUSE-SU-2026:21787-1), Ubuntu (USN-8405-1), and Amazon Linux 2023 (ALAS2023-2026-1668) (SUSE Advisory, Ubuntu Advisory).

The vulnerability was reported by researcher Tomer-PL and published via the OpenPrinting GitHub security advisory program on April 17, 2026. Distribution vendors including SUSE, Ubuntu, and Amazon Linux have issued security updates. The Yocto Project security mailing list also tracked the issue across multiple messages. No significant broader media coverage or notable social media discussion has been identified beyond standard vulnerability tracking and distribution patch announcements (GitHub Advisory, SUSE Advisory, Ubuntu Advisory).