CVE-2026-6645 Details
Description
An insecure process execution vulnerability exists in the pc-printer-updater.exe component of the PaperCut Print Deploy Client for Windows. The application, which typically operates with high-level system privileges, attempts to perform an internal validation check by invoking a secondary system utility using an unqualified file reference. Because the application does not specify an absolute path to this utility, it relies on the operating system's default search order to locate the executable. Under specific conditions, a local attacker with the ability to modify directories within the system's search path could plant a malicious binary that mimics the expected utility. This could result in the malicious code being executed with SYSTEM privileges, leading to a full compromise of the affected host.
A vulnerability allowing insecure process execution has been identified in the PaperCut Print Deploy Client for Windows, specifically within the pc-printer-updater.exe component. This vulnerability arises because the application, which usually runs with high system privileges, calls a secondary system utility using an unqualified file reference. By not providing an absolute path, the application depends on the operating system's default search order to find the executable. Under certain conditions, a local attacker who can modify directories in the system's search path could place a malicious binary that mimics the expected utility. This could lead to the execution of the malicious code with SYSTEM privileges, fully compromising the affected host.
Users are advised to upgrade the PaperCut Print Deploy Client for Windows to version 1.10.4178 or later. For those who manage deployments manually or have disabled automatic updates, version 1.10.4178 or later must be explicitly installed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 22, 2026CISA-ADP
Assessed Jun 22, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://www.papercut.com/kb/Main/papercut-ng-mf-security-bulletin-june-2026/ | PaperCut | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-427 | Uncontrolled Search Path Element | PaperCut |
Affected Products
| Product | Versions |
|---|---|
| PaperCut Print Deploy Client | < 1.10.4178 (semver) |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 23, 2026 | CVE Modified | CISA-ADP |
| Jun 22, 2026 | CVE Modified | CISA-ADP |
| Jun 22, 2026 | New CVE Received | PaperCut |