Hi,

The following vulnerability was published for cups.

CVE-2026-107886[0]:
| OpenPrinting CUPS before 2.4.20 contains a double-free in printer-
| class management. When CUPS-Add-Modify-Class replaces an existing
| class member list, add_class() frees pclass->printers without
| clearing the pointer. If subsequent validation fails, the class
| retains the dangling pointer; CUPS-Delete-Class subsequently frees
| the same allocation in cupsdDeletePrinter(). A client authorized to
| modify and delete classes can cause scheduler-wide denial of
| service. The default policy requires @SYSTEM privileges.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-107886
https://www.cve.org/CVERecord?id=CVE-2026-107886
[1] https://github.com/OpenPrinting/cups/security/advisories/GHSA-pwg4-pv39-8c22
[2] https://github.com/OpenPrinting/cups/commit/13bc9d4f8d695403d54469cc3c8b675e34a7037f

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

We believe that the bug you reported is fixed in the latest version of
cups, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1150557@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Thorsten Alteholz <debian@alteholz.de> (supplier of updated cups package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Thu, 15 Oct 2026 12:40:33 +0200
Source: cups
Architecture: source
Version: 2.4.20-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Printing Team <debian-printing@lists.debian.org>
Changed-By: Thorsten Alteholz <debian@alteholz.de>
Closes: 1147521 1150111 1150555 1150556 1150557 1150558 1150559 1150560 1150561 1150562
Changes:
 cups (2.4.20-1) unstable; urgency=medium
 .
   * Update to new upstream version 2.4.20.
   * introduce new backend usr/lib/cups/backend/testfile for doing
     autopkgtest without using the no longer available file:
   * CVE-2026-107890 (Closes: #1150559)
     NULL pointer dereference while IPP parsing
   * CVE-2026-107888 (Closes: #1150558)
     NULL pointer dereference in cupsdCheckJobs()
   * CVE-2026-107886 (Closes: #1150557)
     double free in printer-class management
   * CVE-2026-107885 (Closes: #1150556)
     resource-exhaustion vulnerability in the submission-timeout
     handling of cupsdCheckJobs()
   * CVE-2026-107655 (Closes: #1150555)
     NULL pointer dereference while handling IPP attributes
   * CVE-2026-105326 (Closes: #1150111)
     mailto-handling
   * CVE-2026-87876 (Closes: #1147521)
     heap out-of-bounds read
   * CVE-2026-87875 (Closes: #1147521)
     printer ACL validation and private-attribute filtering
   * CVE-2026-61702 (Closes: #1150562)
     root-side banner file disclosure
   * CVE-2026-55480 (Closes: #1150561)
     creating of predictable PDD tempfile
   * CVE-2026-55453 (Closes: #1150560)
     ipp backend status-line injection
Checksums-Sha1:
 c402554ea8da1307078855a487057768f9b34db0 3445 cups_2.4.20-1.dsc
 1c85929b72851c2172337522f04b2ad1be7318d9 8164882 cups_2.4.20.orig.tar.gz
 7b90f576a07beb55850a5bda06ff3babce5d2ba0 228 cups_2.4.20.orig.tar.gz.asc
 1657731a6d052da44b01877f84aa23ea0f13c611 388912 cups_2.4.20-1.debian.tar.xz
 1c09a8a90b543b07f4a4bae382b08c2a00d5ada4 13533 cups_2.4.20-1_amd64.buildinfo
Checksums-Sha256:
 69af5c6319f63413989044f6c0f4c8e28efe2204b56fc36b330613464c171e3a 3445 cups_2.4.20-1.dsc
 ab4d9cd7f3e58060091d2b24972223d6401675f11c49b65abf4f6ef31dea22ff 8164882 cups_2.4.20.orig.tar.gz
 4ef44deba02089bdf3e22e54f7880856bb02e8d2750dfed539d0331851f1b010 228 cups_2.4.20.orig.tar.gz.asc
 c35fcb4e2c5218c5a6f2cb307936bad2f5b19fd1c5a7d9a1027c1cb5bd6b4b07 388912 cups_2.4.20-1.debian.tar.xz
 12208888777f41399fbf8062698752263a41710a5e39f1718eb94a48912033ae 13533 cups_2.4.20-1_amd64.buildinfo
Files:
 4659caa3415bbdb9f391783bf73b67ae 3445 net optional cups_2.4.20-1.dsc
 81d6e839434795d649ae5936e62d8a41 8164882 net optional cups_2.4.20.orig.tar.gz
 1fec6eadb6f8701b3688e365cd9070b1 228 net optional cups_2.4.20.orig.tar.gz.asc
 22d494bc0d77b70bdc8a2bdd888cddc0 388912 net optional cups_2.4.20-1.debian.tar.xz
 bf3ff28ac17f6436b5f8c49e8958a7a6 13533 net optional cups_2.4.20-1_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----

iQKnBAEBCgCRFiEEYgH7/9u94Hgi6ruWlvysDTh7WEcFAmrQ7BlfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDYy
MDFGQkZGREJCREUwNzgyMkVBQkI5Njk2RkNBQzBEMzg3QjU4NDcTHGRlYmlhbkBh
bHRlaG9sei5kZQAKCRCW/KwNOHtYR7PzD/42TW4/hjOh3YO802Fs5IodqGehRbBP
2wEiXC1euF6av4Wl8An1ehF7x0p9UrU4v4/i+HCpx8gMUJIYUG6fGbn7yJAxLB01
vG5ZXif3/2SBH5+gDHiV/OqIxzcvqc79sgHcy4Y6ngHQSQBDVi/8zhEfi7GEaCGv
fIJIQZ2rWpkrjCTqBm+e5rU4G/i8MnK/ZHoZMP4KDIGevbhWaMz6I4IjNYdTh4Im
1Klk4sd+DsUVyp54qpffbp6VYF5FQN8D9ifBsRgHAgfn+DjYXe9evlsp3MAtAodH
zVrz89UKyTeDMxegI9EcSUzhcAGISB5KkwQe/YBCW/D1Jh4qcUh0kv4Hxw8VAAdI
PwGFNG2lkLeI0ICQV7srZBvOzDK0xJXkU1GcOV9KG1WC4Y9vX+8/qZaxqfCWqnSQ
ymNZ2SPZ2et+Gy/zDW3BNOZzUOLS3tDzsBe134fL1A8SVNvkv6NCTWUr40pMofXn
LDLxRdEeyEbGPDllpfjRuRWUif+UO3xFePiXiDp51WLHiI6ZiLxIfbE9SFYfLMIP
aPJeX2Bw0FcR7qh0JiM0fAu33EEiiB4ZgZKl/ABggmk2tfVcdPAevTDwvRX2C8Kt
RXqSLtkrdADdIScNml6F3tQAKWOobRUdqmdNtFJoappdHlLZheVqatMWhlwIIBd4
4ZLJd5qiTImHHg==
=HNOA
-----END PGP SIGNATURE-----