{
  "affected": [
    {
      "ranges": [
        {
          "database_specific": {
            "extracted_events": [
              {
                "introduced": "0"
              },
              {
                "fixed": "2.4.20"
              }
            ],
            "source": "AFFECTED_FIELD"
          },
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "ef80eeaea51430a055948240eea3f28ef5354edf"
            }
          ],
          "repo": "https://github.com/openprinting/cups",
          "type": "GIT"
        }
      ]
    }
  ],
  "aliases": [
    "GHSA-7hqf-mfhx-7r3v"
  ],
  "database_specific": {
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
      "CWE-74",
      "CWE-77",
      "CWE-78"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55453.json"
  },
  "details": "OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, the backend/ipp.c quote_string() function preserves carriage-return and line-feed characters in a remote printer-controlled marker-message before report_attr() writes the value to the scheduler status stream. The scheduler can parse an injected newline as a separate PPD: control line and persist an attacker-selected PPD keyword. The reporter demonstrated that a later print job on a Foomatic-backed queue could consume an injected FoomaticRIPCommandLine value and execute in the filter context as lp. This issue is fixed in version 2.4.20.",
  "id": "CVE-2026-55453",
  "modified": "2026-10-16T02:31:14.077803040Z",
  "published": "2026-10-15T17:11:21.208Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55453.json"
    },
    {
      "type": "FIX",
      "url": "https://github.com/OpenPrinting/cups/commit/806e1b483096c51d59432468f4afdd7387d81dd7"
    },
    {
      "type": "FIX",
      "url": "https://github.com/OpenPrinting/cups/commit/d41cf0616688721e9d435d54118c4c8a36ed596a"
    },
    {
      "type": "WEB",
      "url": "https://github.com/OpenPrinting/cups/releases/tag/v2.4.20"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/OpenPrinting/cups/security/advisories/GHSA-7hqf-mfhx-7r3v"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55453"
    }
  ],
  "schema_version": "1.9.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "CUPS ipp backend status-line injection can update queue PPD and lead to conditional RCE as lp via foomatic-rip"
}