Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-09-09T00:00:00 cups: OpenPrinting CUPS: Heap out-of-bounds read in cupsUTF32ToUTF8() via missing source-length bound 4.3 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CWE-125

The cupsUTF32ToUTF8() function in CUPS's cups/transcode.c lacks a source-length bound and can read past the end of the source buffer, resulting in a heap out-of-bounds read. This is reachable via SNMP supply-description parsing in backend/snmp-supplies.c with attacker-controlled content.

The cupsUTF32ToUTF8() function in CUPS's cups/transcode.c lacks a source-length bound and can read past the end of the source buffer, resulting in a heap out-of-bounds read. This is reachable via SNMP supply-description parsing in backend/snmp-supplies.c with attacker-controlled content.

Red Hat would like to thank pant0m (Independent Security Researcher) for reporting this issue. Fixed on upstream master branch with commit 0c6842f and for versions 2.4.x with commit 2b1dc17. Red Hat Hardened Images 2026-09-11T00:00:00Z RHSA-2026:66600 cups-main-2.4.19-4.1.hum1 Red Hat Enterprise Linux 10 Fix deferred cups Red Hat Enterprise Linux 6 Fix deferred cups Red Hat Enterprise Linux 7 Fix deferred cups Red Hat Enterprise Linux 8 Fix deferred cups Red Hat Enterprise Linux 9 Fix deferred cups Red Hat Enterprise Linux 9 Fix deferred rhel9/cups Red Hat OpenShift Container Platform 4 Fix deferred rhcos/rhcos https://www.cve.org/CVERecord?id=CVE-2026-87875 https://nvd.nist.gov/vuln/detail/CVE-2026-87875 https://github.com/OpenPrinting/cups/commit/0c6842fc615e8afa284136a092da8178abf5f142 https://github.com/OpenPrinting/cups/commit/2b1dc178a2d2325135b855142e384f4e8c42d8e4 https://github.com/OpenPrinting/cups/security/advisories/GHSA-559w-7676-3xrq