CVE-2024-47076

OpenPrinting's libcupsfilters, the library providing CUPS filter functionality for printer data-format conversion, fails to sanitize IPP attributes returned from IPP servers in its cfGetPrinterAttributes5 function (CWE-20, CVSS 8.6). The flaw is triggered when a system running CUPS contacts an attacker-controlled or untrusted IPP server and uses the returned attributes, for example to generate a PPD file, allowing attacker-controlled data to flow into the rest of the CUPS system. On its own this yields high-integrity attacker data injection (per the CVSS vector, no direct confidentiality or availability loss), but it is one of several CUPS flaws disclosed together in late September 2024 that, when chained under certain conditions, can result in remote code execution on Linux and Unix systems. Any system running libcupsfilters is affected; CUPS and its filter libraries ship by default with most major Linux distributions, and public internet scans around disclosure found roughly 75,000 hosts exposing the IPP service (TCP 631) directly to the internet. Proof-of-concept details are public (an EvilSocket writeup and the OpenPrinting GitHub advisory GHSA-w63j-6g73-wmg5), the flaw is not yet in CISA KEV, and EPSS assigns a 77.6% probability of exploitation within 30 days, though no confirmed in-the-wild exploitation appears in the provided data.

What to do: Upgrade libcupsfilters to the patched release identified in the OpenPrinting advisory GHSA-w63j-6g73-wmg5 (fixed in libcupsfilters 2.1.0), applying your distribution's updated cups-filters/CUPS packages; also install the companion CUPS component fixes released the same week, since this flaw is typically chained with other CUPS bugs (notably in cups-browsed) for remote code execution. Until patched, restrict or disable exposure of the IPP service (TCP 631) to untrusted networks and avoid creating or refreshing printer queues from untrusted or mDNS-advertised IPP servers.