CVE-2026-39316

CVE-2026-39316 is a use-after-free vulnerability in OpenPrinting CUPS versions 2.4.16 and prior, affecting the cupsd scheduler on Linux and Unix-like systems. The flaw occurs when temporary printers are automatically deleted without properly expiring associated subscriptions, leaving dangling pointers to freed heap memory that are subsequently dereferenced, causing denial of service and potential code execution through heap grooming techniques. The vulnerability carries a CVSS score of 6.2 (Medium) with local attack vector, low complexity, and no special privileges required. The impact is primarily denial of service through cupsd daemon crashes, though the potential for remote code execution exists under specific heap grooming conditions. The EPSS score of 0.00015 indicates this is not currently a high-priority threat compared to other CVEs. Exploitation status shows no active exploitation in the wild, as the vulnerability is not listed on CISA's Known Exploited Vulnerabilities catalog and has not attracted significant community attention. While proof-of-concept code for the denial of service condition could theoretically be developed, the attack requires local access and the elevated complexity of heap manipulation for code execution makes this a lower-priority remediation target for most organizations.