CVE-2026-39314 Details

An integer underflow vulnerability has been identified in OpenPrinting CUPS versions through 2.4.16. The issue arises in the `_ppdCreateFromIPP()` function within `cups/ppd-cache.c`, where the bounds check for the `job-password-supported` IPP attribute only limits the upper value. This flaw allows an unprivileged local user to send a negative integer, which is then improperly validated, cast to a size type, and used to overwrite memory beyond the bounds of a 33-byte stack buffer. The resulting segmentation fault crashes the `cupsd` process, which runs as root. With systemd's `Restart=on-failure` option, this crash can be exploited repeatedly, causing a sustained denial-of-service condition.

It is recommended to add a lower-bound check for the `maxlen` variable in the `_ppdCreateFromIPP()` function to prevent negative values from being accepted. Alternatively, the variable can be managed as an unsigned type to naturally avoid negative values.