Detections
Analytics

Echo: cups: security update to 2.4.18-1

medium Tenable Self-Hosted Container Security Plugin ID 462787

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In
 versions 2.4.16 and prior, in a network-exposed cupsd with a shared target queue, an unauthorized client
 can send a Print-Job to that shared PostScript queue without authentication. The server accepts a page-
 border value supplied as textWithoutLanguage, preserves an embedded newline through option escaping and
 reparse, and then reparses the resulting second-line PPD: text as a trusted scheduler control record. A
 follow-up raw print job can therefore make the server execute an attacker-chosen existing binary such as
 /usr/bin/vim as lp. At time of publication, there are no publicly available patches. (CVE-2026-34980)

Solution

Update the cups library and its related packages to version 2.4.18-1 or later.

See Also

https://advisory.echohq.com/cve/CVE-2026-34980

Plugin Details

Severity: Medium

ID: 462787

Version: Revision 1.1

Type: Local

Published: 10/2/2026

Updated: 10/2/2026

Risk Information

VPR

Risk Factor: High

Score: 7.7

Percentile: 98.93

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Temporal Score: 5.6

Vector: CVSS2#AV:A/AC:H/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2026-34980

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 7

Vector: CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:F/RL:O/RC:C

CVSS v4

Risk Factor: Medium

Base Score: 6.1

Threat Score: 5.6

Threat Vector: CVSS:4.0/E:P

Vector: CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 4/4/2026

Vulnerability Publication Date: 4/3/2026

Exploitable With

Core Impact

Reference Information

CVE: CVE-2026-34980