A heap‑based buffer overflow occurs in the CUPS scheduler while building filter option strings from job attributes. The overflow exposes a vulnerability that could lead to arbitrary memory corruption, potentially allowing an attacker to execute code or cause a denial of service. The weakness falls under CWE‑120 and CWE‑122.

OpenPrinting CUPS version 2.4.16 and earlier on Linux and other Unix‑like operating systems are affected. This includes all distributions that ship the default CUPS scheduler component.

The CVSS score of 5.3 indicates moderate severity, and the EPSS score is not publicly available, leaving the likelihood of exploitation uncertain. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is remote via the printing service, though local privilege escalation cannot be ruled out.