Description
The cupsUTF32ToUTF8() function in CUPS's cups/transcode.c lacks a source-length bound and can read past the end of the source buffer, resulting in a heap out-of-bounds read. This is reachable via SNMP supply-description parsing in backend/snmp-supplies.c with attacker-controlled content.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Red Hat Red Hat Hardened Images
Default version status: affected
2.4.19-4.1.hum1 to < *unaffected
Red Hat Red Hat Enterprise Linux 10
Default version status: affected
Red Hat Red Hat Enterprise Linux 6
Default version status: affected
Red Hat Red Hat Enterprise Linux 7
Default version status: affected
Red Hat Red Hat Enterprise Linux 8
Default version status: affected
Red Hat Red Hat Enterprise Linux 9
Default version status: affected
Red Hat Red Hat Enterprise Linux 9
Default version status: affected
Red Hat Red Hat OpenShift Container Platform 4
Default version status: affected
References
- https://access.redhat.com/errata/RHSA-2026:66600 ↗
- https://access.redhat.com/security/cve/CVE-2026-87875 ↗
- https://bugzilla.redhat.com/show_bug.cgi?id=2530994 ↗
- https://github.com/OpenPrinting/cups/commit/0c6842fc615e8afa284136a092da8178abf5f142 ↗
- https://github.com/OpenPrinting/cups/commit/2b1dc178a2d2325135b855142e384f4e8c42d8e4 ↗
- https://github.com/OpenPrinting/cups/security/advisories/GHSA-559w-7676-3xrq ↗