OpenPrinting CUPS allows a remote print client to inject carriage–return and line–feed characters into a marker‑message that the scheduler writes to the status stream. The injected newline is interpreted as a separate PPD control line, enabling an attacker to set a chosen PPD keyword. If the printed job later uses a Foomatic‑backed queue, the injected FoomaticRIPCommandLine value is processed by the filter as the user lp, allowing the attacker to execute arbitrary commands in that context. The flaw therefore constitutes a conditional remote code execution path for the account that runs the printer filter, typically lp.

The vulnerability affects all releases of OpenPrinting CUPS older than version 2.4.20. Any Unix‑like system deploying CUPS that has not applied the 2.4.20 update is potentially exploitable.

The CVSS score of 3.3 indicates a low overall severity. The EPSS score is less than 1%, indicating a very low likelihood of exploitation. The flaw is not listed in the CISA KEV catalog. The attack vector is remote over the IPP backend; an unauthenticated or authenticated client can send an IPP request that includes the marker message. Once the attacker succeeds, the impact escalates to remote code execution executed as the lp user.