In CUPS, the copy_model() routine built before version 2.4.20 creates a temporary PPD file with a predictable name inside a directory that is writable by the lp group. The routine opens the file as the root user without using the O_EXCL or O_NOFOLLOW flags, which allows a race condition where a local lp group process can create a symbolic link to an arbitrary file before the root user opens the target. If the attack succeeds, the root scheduler will follow the symlink and overwrite the target file, compromising file integrity or availability. This flaw does not grant code execution but allows a privileged user to modify or destroy arbitrary root‑owned files.

The vulnerability affects all installations of OpenPrinting CUPS that use a temporary directory writable by the lp group and run any version prior to 2.4.20. The repository notes that the issue is fixed in release 2.4.20; systems using that or later versions are not affected.

The vulnerability has a CVSS score of 5.7, which indicates a moderate impact. The EPSS score of less than 1% suggests that exploitation is unlikely but not impossible; it is not listed in the CISA KEV catalog. Exploitation requires two distinct conditions: a local lp group foothold that can create the symlink in the temp directory and a privileged action such as adding or modifying a printer that triggers copy_model(). Once both prerequisites are met, the race can succeed, leading to root‑level file overwrite. The risk is higher in environments where lp group users have write access to CUPS’s temporary directories or where CUPS is improperly configured to allow group write access to these directories.