CUPS versions 2.4.16 and earlier allow an attacker who can access a network‑exposed cupsd with a shared PostScript queue to send a Print‑Job without authentication. The server accepts a page‑border value, preserves an embedded newline, re‑escapes and re‑parses the resulting text, and then interprets the second‑line PPD as a trusted scheduler control record (CWE‑20). A follow‑up raw print job can cause the scheduler to execute an attacker‑chosen binary, such as /usr/bin/vim, under the privileges of the lp user (CWE‑78). This yields remote code execution without requiring any privileged authentication.

The vulnerability impacts the OpenPrinting CUPS printing system on any Linux or Unix‑like operating system where cupsd is exposed over the network and a target queue is marked as shared. It applies to installations running CUPS 2.4.16 or earlier regardless of the specific distribution or configuration.

The CVSS score of 6.1 indicates moderate severity. EPSS data is not available and the issue is not listed in the CISA KEV catalog, but the lack of authentication combined with network exposure makes exploitation straightforward for any adversary with network access to the cupsd daemon. The attack requires only a crafted Print‑Job sent to the shared queue; additional constraints such as firewall restriction or disabling shared queues reduce the attack surface. Until a patch is released, exposed hosts remain at significant risk of remote code execution.