CVE-2024-47076 HIGH

CVE-2024-47076: libcupsfilters's cfGetPrinterAttributes5 does not validate IPP attributes returned from an IPP server

Vendor Openprinting
Product libcupsfilters
Weakness CWE-20 · Input validation
Published September 26, 2024
Last update November 3, 2025
View on NVD All CVEs

CVSS base score

8.6/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality None
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

What the vulnerability does

01Description

CUPS is a standards-based, open-source printing system, and `libcupsfilters` contains the code of the filters of the former `cups-filters` package as library functions to be used for the data format conversion tasks needed in Printer Applications. The `cfGetPrinterAttributes5` function in `libcupsfilters` does not sanitize IPP attributes returned from an IPP server. When these IPP attributes are used, for instance, to generate a PPD file, this can lead to attacker controlled data to be provided to the rest of the CUPS system.

Key dates

02Disclosure timeline

September 26, 2024 CVE published
November 3, 2025 Record updated