Spooler Alert: Remote Unauth'd RCE-to-root Chain in CUPS

Sun, 05 Apr 2026 00:00:00 +0000

TLDR: my self-orchestrating team of vulnerability hunting agents discovered two issues in CUPS, CVE-2026-34980 and CVE-2026-34990, chainable into unauthenticated remote attacker -> unprivileged RCE -> root file (over)write. See below for the prerequisites, details, and mitigation options.

Intro
#

CUPS is the standard way to do printing on Linux and other Unix(-like) systems. It’s been on my mind as a research target ever since doing incident response to Simone Margaritelli’s 2024 unauth’d RCE finding, where he chained several CUPS vulnerabilities into an unauth’d RCE as lp, the default CUPS service user.

Posts on Hey, it's Asim

Spooler Alert: Remote Unauth'd RCE-to-root Chain in CUPS

Intro #

Intro
#