CVE-2026-34990

CVE-2026-34990 affects OpenPrinting CUPS versions 2.4.16 and prior, allowing a local unprivileged user to achieve arbitrary root file overwrite and subsequent root command execution. This is accomplished by coercing cupsd into authenticating to an attacker-controlled IPP service, enabling the creation of a malicious shared printer queue. Rated as Medium severity (CVSS 5.0), exploitation requires local access but no user interaction. While a Proof-of-Concept is mentioned in the description, there are no publicly available exploits, evidence of active exploitation, or significant community discussion at this time. Patches for this vulnerability are not yet available.