The vulnerability appears in OpenPrinting CUPS versions 2.4.16 and earlier. An unprivileged local user can trick the CUPS server into authenticating to a malicious localhost IPP service using a reusable Local token. That token allows the attacker to make administrative requests on localhost, and by creating a shared local printer with a file:// URI, the attacker can persist a malicious queue. Printing to that queue triggers an arbitrary root file overwrite, which the proof‑of‑concept shows can drop a sudoers fragment and execute commands with root privileges. The weakness involves authentication bypass (CWE-287) and path manipulation (CWE-73).

OpenPrinting CUPS 2.4.16 and earlier running on Linux or other Unix‑like operating systems are affected. This includes any distribution that ships the 2.4.16 release or older versions of CUPS.

The CVSS score of 5.0 denotes a moderate risk. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting it may not yet be widely exploited. However, the attack requires only local, unprivileged user access, making the exploitation barrier low within a compromised host. Once authenticated via the Local token, administrative actions on the CUPS server can be performed, allowing the attacker to persist malicious printers and achieve root-level file overwrite.