{"id":"CVE-2026-55467","revision":"c3d15882fa534a05820dac001a620c10","records":[{"revision":"c3d15882fa534a05820dac001a620c10","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-55467","aliases":[],"title":"CUPS fax option values bypass the CVE-2026-34980 control-character sanitizer (incomplete fix)","description":"OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, the cupsdCreateJob option-string builder in scheduler/job.c maps attacker-controlled destination-uri and pre-dial-string values from a configured fax queue to the phone and faxPrefix options. Unlike ordinary IPP job attributes, these mapped fax values bypass the control-character sanitizer and are copied directly into the filter options argument. A user permitted to submit a job can therefore inject control characters into the downstream option stream. The reporter states that a downstream fax filter passing these values to a shell or modem command could execute code as lp, while the maintainer states that CUPS has no confidentiality or integrity impact because the only known code-executing filter is optional Foomatic and addressed separately, leaving possible disruption of the affected queue. This issue is fixed in version 2.4.20.","state":0,"publishedAt":"2026-10-15T17:08:24.374+00:00","modifiedAt":"2026-10-15T17:49:26.673+00:00","affected":[{"ecosystem":"Vendor product","name":"cups","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"OpenPrinting\",\n                    \"product\": \"cups\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 2.4.20\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L","score":2.5,"severity":"LOW"}],"references":["https://github.com/OpenPrinting/cups/security/advisories/GHSA-69qc-prxg-h2c7","https://github.com/OpenPrinting/cups/commit/0cf4e7814d6810ed3c454222bce3aa342d541681","https://github.com/OpenPrinting/cups/commit/a9e7e7a3a019d0fa063d29409d3f82e4c6d5a008","https://github.com/OpenPrinting/cups/releases/tag/v2.4.20"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-55467","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-55467","identifiers":["CVE-2026-55467"]},"retained":false,"historicalAffected":[]}],"coverage":[]}