OpenPrinting CUPS is an open source printing system for Linux and other Unix‑like operating systems. Prior to 2.4.17, an attacker adjacent to the network can send a crafted SNMP response to the CUPS SNMP backend that triggers an out‑of‑bounds read of up to 176 bytes past a stack buffer. The leaked memory is converted from UTF‑16 to UTF‑8 and stored as printer supply description strings, which are then visible to authenticated users via IPP Get‑Printer‑Attributes responses and the CUPS web interface, illustrating a CWE‑125 (Out‑of‑Bounds Read) that results in a CWE‑200 (Information Exposure).

Versions of OpenPrinting CUPS older than 2.4.17 are affected. The vulnerability applies to the CUPS SNMP backend used on Linux and other Unix‑like systems. Updating to CUPS 2.4.17 or newer eliminates the bug; no other versions are known to be impacted.

With a CVSS score of 4.3 the assessment rate is 'low' severity. The EPSS score of less than 1% indicates a low probability of exploitation in the wild. The vulnerability is not listed in CISA's KEV catalog. Based on the description, it is inferred that an attacker must be a network‑adjacent actor able to send a crafted SNMP response to the CUPS SNMP backend and that authenticated access to the server is required to read the leaked supply descriptions. The exposure is limited to information disclosure, and this could aid further reconnaissance, as inferred from the nature of leaked data.