CVE-2026-107888

Name	CVE-2026-107888
Description	OpenPrinting CUPS before 2.4.20 contains a NULL pointer dereference in cupsdCheckJobs() when a job marked job-held-on-create refers to a temporary printer that has been automatically deleted. Temporary-printer cleanup can remove the destination without canceling its held jobs, and the scheduler dereferences the NULL result of cupsdFindDest() while checking holding_new_jobs. This terminates cupsd and interrupts all queues managed by that process. In some plausible scenarios, an unprivileged submission can trigger this.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1150558

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
cups (PTS)	bookworm, bookworm (security)	2.4.2-3+deb12u9	vulnerable
	trixie	2.4.10-3+deb13u2	vulnerable
	trixie (security)	2.4.10-3+deb13u1	vulnerable
	forky	2.4.18-1	vulnerable
	sid	2.4.20-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
cups	source	(unstable)	2.4.20-1			1150558

Notes

https://github.com/OpenPrinting/cups/security/advisories/GHSA-qqm8-4q5h-jg55
Fixed by: https://github.com/OpenPrinting/cups/commit/c5fc041ca0a211f8e69854907be7b55f56955659 (v2.4.20)