CVE-2024-47175

CVE-2024-47175 is an improper input validation flaw (CWE-20) in OpenPrinting's libppd: the ppdCreatePPDFromIPP2 function fails to sanitize IPP attributes when writing them into a generated PPD buffer. When this unsanitized, attacker-controlled input flows through the CUPS print pipeline — for example via the cups-browsed entry point abused in CVE-2024-47176, in combination with functions such as cfGetPrinterAttributes5 — it can ultimately be executed by Foomatic print filters, giving remote code execution. Affected systems are Linux/Unix hosts running the CUPS printing stack with vulnerable libppd components, which includes widely used distributions such as Debian and, per press coverage, most other major Linux distros. Exploitation status: public proofs of concept and researcher write-ups exist, the flaw carries a high EPSS score (63.6% probability of exploitation within 30 days, 99th percentile) and warnings about abuse including DDoS, but it is not yet in CISA's KEV catalog, so no confirmed widespread in-the-wild exploitation is documented in the available data.

What to do: Install your distribution's security updates — upgrade libppd to the patched release (2.1b1 or later, per the OpenPrinting advisory GHSA-7xfx-47qg-grp6) and apply the matching cups/cups-filters fixes. As interim mitigation, disable or stop cups-browsed if not needed and block or restrict inbound UDP 631 (and IPP/port 631 generally) from untrusted networks, particularly on internet-facing hosts. Check whether CUPS is running and reachable on your systems and whether configured printers rely on Foomatic filters, which the RCE chain requires.