Skip to content
NewA calmer, faster ZeroHour
Advisoryhigh

ZDI-26-656: PAPPL Job Processing Heap-based Buffer Overflow Remote Code Execution Vulnerability

ZDI Published Advisories ()1
Read at zerodayinitiative.com
Part of a story covered by 2 sourcesZero Day Initiative discloses two PAPPL buffer overflows: unauthenticated RCE rated CVSS 9.8 and local privilege escalation rated CVSS 7.8Merged summary & timeline
AI summary · glm-5.3-flashSummaries by Vani AI

ZDI-26-656: Unauthenticated heap-based buffer overflow in PAPPL job processing allows remote code execution, rated CVSS 9.8.

The Zero Day Initiative published advisory ZDI-26-656 for PAPPL, the open-source printer application framework. A heap-based buffer overflow in job processing allows remote attackers to execute arbitrary code with no authentication required. ZDI assigned a CVSS 9.8 rating. No CVE identifier was listed in the advisory text.

Key facts
  • Unauthenticated remote code execution in PAPPL job processing
  • Heap-based buffer overflow with CVSS 9.8
  • Disclosure coordinated by the Zero Day Initiative
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat
Tags
heap-overflowpapplprintingrcezdi
Vendors
OpenPrinting
Products
PAPPL
Organizations
Zero Day Initiative

From the original article

This vulnerability allows remote attackers to execute arbitrary code on affected installations of PAPPL. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 9.

ZDI Published Advisories

zerodayinitiative.com

Read the full article at ZDI Published Advisories

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.