CVE Feed

    Dashboard / CVE / CVE-2026-95511

    CVE-2026-95511

    Not a vulnerability. Creating a serial queue that overwrites cups-files.conf requires membership in SystemGroups (lpadmin), which is an opt-in cupsd admin role granted by a superuser. No privilege boundary is crossed.

    Published:Sep 18, 2026
    Last Modified:Sep 23, 2026
    EPS:Sep 22, 2026
    EPSS Score:
    CVSS Score:8.2

    Affected Products

    Vendor
    Cups
    Product
    Cups
    Vendor
    Redhat
    Product
    Enterprise Linux
    Vendor
    Redhat
    Product
    Hardened Images

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-269 Improper Privilege Management

    Related CVEs

    CVE-2026-107655 (CVSS 4) — A flaw was found in CUPS. When processing embedded job ticket comments within documents, the service improperl…
    CVE-2026-105326 (CVSS 2.5) — An argument injection flaw was found in CUPS. When email notification is configured, the CUPS scheduler accept…
    CVE-2024-47850 (CVSS 7.5) — CUPS cups-browsed before 2.5b1 will send an HTTP POST request to an arbitrary destination and port in response…
    CVE-2018-6553 (CVSS 8.8) — The CUPS AppArmor profile incorrectly confined the dnssd backend due to use of hard links. A local attacker co…
    CVE-2015-1159 (CVSS 4.3) — Cross-site scripting (XSS) vulnerability in the cgi_puts function in cgi-bin/template.c in the template engine…
    CVE-2015-1158 (CVSS 10) — The add_job function in scheduler/ipp.c in cupsd in CUPS before 2.0.3 performs incorrect free operations for m…
    CVE-2014-8166 (CVSS 8.8) — The browsing feature in the server in CUPS does not filter ANSI escape sequences from shared printer names, wh…
    CVE-2008-1722 (CVSS 4.3) — Multiple integer overflows in (1) filter/image-png.c and (2) filter/image-zoom.c in CUPS 1.3 allow attackers t…
    CVE-2008-0047 (CVSS 9.3) — Heap-based buffer overflow in the cgiCompileSearch function in CUPS 1.3.5, and other versions including the ve…
    CVE-2008-0882 (CVSS 10) — Double free vulnerability in the process_browse_data function in CUPS 1.3.5 allows remote attackers to cause a…

    References

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High