The vulnerability arises when the CUPS printing service processes embedded job ticket comments in a print job. An improper handling of specific IPP attributes triggers a null pointer dereference, causing the print daemon to crash. The resulting temporary denial of service affects all jobs submitted to the affected printer queue. The weakness is cataloged as CWE-476.

Red Hat Hardened Images includes the CUPS service via the Red Hat Hummingbird platform. No specific affected CUPS release is listed, so the issue exists in the current CUPS package deployed on that platform.

The CVSS score of 4 indicates moderate severity. EPSS is not available, but the vulnerability is not listed in the CISA KEV catalog. An attacker only needs to be able to submit IPP print jobs to a shared queue; authentication is not required. The exploit does not provide remote code execution or privilege escalation, but can cause temporary service disruption.