OpenPrinting CUPS contains a use‑after‑free bug in the function that deletes temporary printers. When cupsdDeleteTemporaryPrinters() frees a printer without expiring subscriptions that reference it, the subscription structure holds a dangling pointer to freed heap memory. Subsequent dereferences of that pointer crash the cups daemon, resulting in a denial of service. With carefully orchestrated heap grooming, this dangling reference can be leveraged for code execution, thereby elevating the threat beyond a simple crash.

The vulnerability affects installations of OpenPrinting CUPS version 2.4.16 and earlier on Linux and other Unix‑like operating systems. Any system that uses temporary printers that can be automatically deleted is impacted, as the flaw resides in the cups daemon’s scheduler component.

The CVSS score of 4 indicates a moderate severity. The EPSS score is unavailable and the flaw is not listed in CISA’s KEV catalog. The likely attack vector is local or privileged; an attacker who can create or delete temporary printers can trigger the use‑after‑free, which then causes a crash. Remote exploitation for code execution would require further steps such as heap grooming and privileged access, making it less straightforward to automate.