---
id: CVE-2026-107890
title: >-
  OpenPrinting CUPS before 2.4.20 contains a NULL pointer dereference caused by
  repeated IPP group tags in job-creation requests
summary: >-
  OpenPrinting CUPS before 2.4.20 contains a NULL pointer dereference caused by
  repeated IPP group tags in job-creation requests. IPP parsing creates unnamed
  separator attributes with IPP_TAG_ZERO, but add_job() converts these
  separators t…
severity: low
cvss: 3.3
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L'
cwe:
  - CWE-476
published: '2026-10-09'
updated: '2026-10-09'
sourceUpdated: '2026-10-09T05:16:44.730'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-107890'
references:
  - url: >-
      https://github.com/OpenPrinting/cups/security/advisories/GHSA-wjc4-qhjr-5m5x
    label: cve@mitre.org
tags:
  - nvd
ingestedAt: '2026-10-09T05:26:07.005Z'
---

## Overview

OpenPrinting CUPS before 2.4.20 contains a NULL pointer dereference caused by repeated IPP group tags in job-creation requests. IPP parsing creates unnamed separator attributes with IPP_TAG_ZERO, but add_job() converts these separators to IPP_TAG_JOB. During job startup, get_options()/ipp_length() subsequently calls strlen() on a NULL attribute name, terminating cupsd and disrupting all queues. A single crafted Print-Job request can trigger the crash when the client can reach the scheduler and submit jobs to an accepting, enabled queue supporting the submitted document format. Anonymous submission is possible when permitted by listener and access-control configuration.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.