Description

The cupsUTF32ToUTF8() function in CUPS's cups/transcode.c lacks a source-length bound and can read past the end of the source buffer, resulting in a heap out-of-bounds read. This is reachable via SNMP supply-description parsing in backend/snmp-supplies.c with attacker-controlled content.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-09-09T17:17:53.240Z",
  "pubdate": "2026-09-09T17:17:53.240Z",
  "executiveSummary": "CUPS (Common Unix Printing System) is affected by a severe security vulnerability within its character set conversion subsystem, specifically during the transcoding of UTF-32 data to UTF-8. The vulnerability manifests as a heap out-of-bounds read condition, arising from a deficiency in validation checks within the cupsUTF32ToUTF8() function located in cups/transcode.c.\nThis flaw can be triggered remotely by an unauthenticated attacker who can deliver malicious, attacker-controlled content via SNMP network traffic. The primary attack vector involves the SNMP supply-description parsing functionality implemented in backend/snmp-supplies.c. If exploited, this vulnerability could allow an attacker to read sensitive memory contents from the heap buffer, potentially leading to information disclosure, denial of service (DoS) via application crashes, or assisting in bypassing exploit mitigation techniques such as Address Space Layout Randomization (ASLR). Organizations utilizing CUPS with SNMP enabled for printer and supply discovery are at risk. Mitigating this vulnerability requires restricting SNMP access or updating the CUPS software package to a version containing validation bounds for UTF-32 source streams.",
  "technicalDetails": "The root cause of this vulnerability lies within the implementation of the cupsUTF32ToUTF8() function in the cups/transcode.c source file of the CUPS printing system. This function is designed to convert UTF-32 encoded characters into the widely used UTF-8 format. However, the implementation fails to enforce strict source-length boundaries during the transcoding process. When processing UTF-32 input, the function relies on terminating characters or implicit boundaries rather than validated length limits. Consequently, if the function is supplied with malformed or truncated UTF-32 data that lacks proper termination, it will continue reading data beyond the allocated boundaries of the source buffer on the heap.\nIn a standard character conversion routine, the parser expects input formatted in 4-byte (32-bit) units. When the source buffer length is not strictly bounded, the parsing loop continues to increment its pointer, assuming more valid UTF-32 characters exist. This behavior forces the execution environment to read adjacent memory segments allocated to other heap objects.\nThis heap out-of-bounds read vulnerability is reachable over the network via the CUPS SNMP backend. Specifically, the vulnerability path starts when the CUPS daemon performs discovery or status monitoring of network printers using the Simple Network Management Protocol (SNMP). The SNMP response parsing logic, located in backend/snmp-supplies.c, processes supply-description strings returned from network devices. If an attacker simulates a printer or compromises an existing network-attached printer, they can return malicious SNMP responses containing crafted, attacker-controlled supply descriptions.\nThe attack flow proceeds as follows: 1. The CUPS system initiates an SNMP query to gather supply information from network devices. 2. The attacker-controlled SNMP agent responds with a payload containing a crafted, malformed UTF-32 string representing a supply description. 3. The CUPS SNMP backend receives the response and passes the supply-description string to the parsing logic in backend/snmp-supplies.c. 4. To process or display the string, the backend invokes the transcoding function cupsUTF32ToUTF8() in cups/transcode.c. 5. Because cupsUTF32ToUTF8() lacks source-length bounds checks, the function reads past the allocated heap buffer boundary containing the SNMP data. 6. This out-of-bounds read allows the application to access adjacent heap memory, potentially causing a crash (Denial of Service) or transmitting the leaked heap data back to the attacker or log files, leading to information disclosure.\nAs this process occurs automatically during routine SNMP scanning or query operations, no local authentication or administrative privileges are required to trigger the exploit. The primary exposure vector is network-based, specifically targeting the ports and services running CUPS backends that perform SNMP discovery."
}