The integer underflow occurs in the _ppdCreateFromIPP function when the job-password-supported IPP attribute is supplied as a negative value. The bounds check only caps the upper limit, allowing the negative value to pass validation and be cast to a size_t. That value is then used as the length argument to memset on a 33‑byte stack buffer, causing an immediate segmentation fault in the cupsd root process. The result is a denial of service that can be repeatedly triggered by an unprivileged local user.

OpenPrinting CUPS, versions 2.4.16 and earlier, running on Linux and other Unix‑like operating systems, is affected. This includes the standard cupsd service that processes print jobs and is often started automatically via systemd.

The CVSS score of 4.0 indicates a low overall risk, and the exploit probability is not published. The vulnerability has not been listed in the CISA KEV catalog, suggesting it has not yet been widely exploited. The attack vector is local; an unprivileged user can send a crafted print job containing a negative job-password-supported attribute to trigger the crash. Because systemd is configured to restart cupsd on failure, the denial of service can be sustained until the service is patched or stopped. No remote exploitation path is reported.