CVE-2026-34978

CVE-2026-34978 is a path traversal vulnerability affecting OpenPrinting CUPS versions 2.4.16 and prior, allowing a remote IPP client to write RSS XML bytes outside the designated cache directory. Rated Medium (CVSS 6.5), this unauthenticated, low-complexity flaw enables a network attacker to overwrite critical CUPS state files by manipulating the notify-recipient-uri. Successful exploitation can lead to a denial of service, causing the CUPS scheduler to fail and previously queued jobs to disappear upon service restart. There are no publicly available patches or known exploit code, and the vulnerability currently shows minimal community discussion or media coverage, suggesting a low immediate exploitation risk.