The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1776767380 advisory.

  - OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In     versions 2.4.16 and prior, in a network-exposed cupsd with a shared target queue, an unauthorized client     can send a Print-Job to that shared PostScript queue without authentication. The server accepts a page-     border value supplied as textWithoutLanguage, preserves an embedded newline through option escaping and     reparse, and then reparses the resulting second-line PPD: text as a trusted scheduler control record. A     follow-up raw print job can therefore make the server execute an attacker-chosen existing binary such as     /usr/bin/vim as lp. At time of publication, there are no publicly available patches. (CVE-2026-34980)

  - OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In     versions 2.4.16 and prior, an integer underflow vulnerability in _ppdCreateFromIPP() (cups/ppd-cache.c)     allows any unprivileged local user to crash the cupsd root process by supplying a negative job-password-     supported IPP attribute. The bounds check only caps the upper bound, so a negative value passes     validation, is cast to size_t (wrapping to ~2^64), and is used as the length argument to memset() on a     33-byte stack buffer. This causes an immediate SIGSEGV in the cupsd root process. Combined with systemd's     Restart=on-failure, an attacker can repeat the crash for sustained denial of service. (CVE-2026-39314)

  - OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In     versions 2.4.16 and prior, a use-after-free vulnerability exists in the CUPS scheduler (cupsd) when     temporary printers are automatically deleted. cupsdDeleteTemporaryPrinters() in scheduler/printers.c calls     cupsdDeletePrinter() without first expiring subscriptions that reference the printer, leaving     cupsd_subscription_t.dest as a dangling pointer to freed heap memory. The dangling pointer is subsequently     dereferenced at multiple code sites, causing a crash (denial of service) of the cupsd daemon. With heap     grooming, this can be leveraged for code execution. (CVE-2026-39316)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

AlmaLinux 9.2 [TuxCare] Security Update: cups / cups-client / cups-devel / cups-filesystem / cups-ipptool / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1776767380)

medium Nessus Plugin ID 360119

Version 1.2

Version 1.1

Version 1.2 Oct 2, 2026, 8:05 AM Exploit attributes ("Exploit framework core" set to "True") Plugin Feed: 202610020805
Version 1.1 Oct 1, 2026, 9:59 PM New Plugin Feed: 202610012159