The defect resides in CUPS’ option‑string constructor for fax jobs, which copies the user‑controlled destination‑uri and pre‑dial‑string straight into fax‑filter parameters without applying the control‑character sanitizer. Because these values can contain arbitrary control sequences, a user who can submit a fax job may inject commands that a downstream filter such as the optional Foomatic interpreter forwards to a shell or modem driver, potentially allowing code to run as the privileged lp user. Even if the exploited filter is absent, the injected control characters can still corrupt the fax job or queue, leading to service disruption. The flaw therefore represents a low‑severity vulnerability that can cause either code execution or operational breakdown of fax queues.

The issue affects the OpenPrinting CUPS printing system running on Linux and other Unix‑like operating systems. Any CUPS deployment of version 2.4.19 or earlier, where the option‑string builder was not yet patched, is susceptible. Starting with CUPS 2.4.20, the control‑character sanitizer is applied to fax options, eliminating the vulnerability; therefore systems running 2.4.20 or newer are not affected.

The CVSS score of 2.5 signals a minor impact and limited privileges; the EPSS score of < 1% indicates a very low exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker who can submit a print job to a fax queue with user‑controlled attributes and a downstream fax filter capable of executing shell commands. If such a filter is absent, the attacker’s ability to create code is limited, and the outcome is restricted to queue corruption rather than privilege escalation. Consequently, the attack vector is user‑initiated job submission, and the overall risk remains moderate but should not be ignored, especially on systems that accept unauthenticated printing or run optional fax filters.