CUPS security advisory (AV26-326)

Serial number: AV26-326
Date: April 8, 2026

On April 5, 2026, OpenPrinting published security advisories to address vulnerabilities in the following product:

• Common UNIX Printing Systems (CUPS) - version 2.4.16 and prior

The Cyber Centre encourages users and administrators to review the provided web links, perform the suggested mitigations and apply the necessary updates once available.

The Cyber Centre encourages users and administrators to review the provided web link and apply the necessary updates.

• Spooler Alert: Remote Unauth'd RCE-to-root Chain in CUPS
• Local print admin token disclosure using temporary printers (CVE-2026-34990)
• Shared PostScript queue lets anonymous Print-Job requests reach `lp` code execution over the network (CVE-2026-34980)