CVE-2026-95511
Description
A privilege escalation vulnerability was found in CUPS when used with the cups-filters serial backend. A local user who is a member of the lpadmin group can configure a printer that uses a privileged serial backend. The CUPS scheduler does not restrict the path component of non-file device URIs, so the root-privileged backend can write attacker-controlled print data to an arbitrary file. This can be used to change security-sensitive CUPS configuration and ultimately achieve root code execution. Exploitation requires local lpadmin group membership and a serial backend binary installed with root-only permissions.
Statement
This vulnerability is rated as Important because a local user with CUPS administrator rights (lpadmin group) can escalate to operating-system root. Exploitation is not remote and is not available to an unprivileged local user who is not in a CUPS SystemGroup. The published cups2root chain depends on a serial backend that OpenPrinting CUPS no longer builds, but Red Hat products and Fedora still ship that backend from cups-filters, installed so that cupsd runs it as root. SELinux in enforcing mode provides additional restriction on cupsd file access and may prevent some write targets, but is not treated as a complete fix. Red Hat Enterprise Linux 8, 9, and 10, and Fedora, ship cups-filters with the serial backend and are affected. Products that ship CUPS without the cups-filters serial backend are not affected by this specific chain.
Mitigation
There is no complete mitigation while the serial backend remains installed as a root backend. The following steps reduce risk:
1. If serial printers are not required, remove the serial backend package file or change its permissions so cupsd no longer runs it as root, for example: chmod 0755 /usr/lib/cups/backend/serial (path may be /usr/libexec/cups/backend/serial).
2. Restrict lpadmin (and other SystemGroup) membership to users who are already trusted with root-equivalent access.
3. Leave FileDevice unset or set to No in /etc/cups/cups-files.conf.
4. Keep SELinux in enforcing mode. The cupsd_t domain may block some of the file writes used in this chain.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 8.2 | N/A | N/A |
| Attack Vector | Local | N/A | N/A |
| Attack Complexity | Low | N/A | N/A |
| Privileges Required | High | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Changed | N/A | N/A |
| Confidentiality | High | N/A | N/A |
| Integrity Impact | High | N/A | N/A |
| Availability Impact | High | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Red Hat CVSS v3 Score Explanation
Local privilege escalation from lpadmin to root. PR:H because lpadmin is granted CUPS administrative access. Scope Changed because the CUPS authorization boundary is crossed to OS root.
Understanding the Weakness (CWE)
Access Control
Technical Impact: Gain Privileges or Assume Identity
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
