CVE-2026-87875 PUBLISHED

Cups: openprinting cups: heap out-of-bounds read in cupsutf32toutf8() via missing source-length bound

Assigner: redhat
Reserved: 09.09.2026 Published: 09.09.2026 Updated: 09.09.2026

The cupsUTF32ToUTF8() function in CUPS's cups/transcode.c lacks a source-length bound and can read past the end of the source buffer, resulting in a heap out-of-bounds read. This is reachable via SNMP supply-description parsing in backend/snmp-supplies.c with attacker-controlled content.

Metrics

CVSS Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS Score: 4.3

Product Status

Vendor Red Hat
Product Red Hat Enterprise Linux 10
Versions Default: affected
Vendor Red Hat
Product Red Hat Enterprise Linux 6
Versions Default: affected
Vendor Red Hat
Product Red Hat Enterprise Linux 7
Versions Default: affected
Vendor Red Hat
Product Red Hat Enterprise Linux 8
Versions Default: affected
Vendor Red Hat
Product Red Hat Enterprise Linux 9
Versions Default: affected
Vendor Red Hat
Product Red Hat Enterprise Linux 9
Versions Default: affected
Vendor Red Hat
Product Red Hat Hardened Images
Versions Default: affected
Vendor Red Hat
Product Red Hat OpenShift Container Platform 4
Versions Default: affected

Workarounds

Fixed on upstream master branch with commit 0c6842f and for versions 2.4.x with commit 2b1dc17.

Credits

  • Red Hat would like to thank pant0m (Independent Security Researcher) for reporting this issue.

References

Problem Types

  • Out-of-bounds Read CWE