Multiple Vulnerabilities Disclosed in Linux-based CUPS Printing Service

Arctic Wolf Labs reports four newly disclosed vulnerabilities in CUPS and related libraries that allow attacker-controlled IPP attributes to be passed through, injected into PPD files, or used to achieve arbitrary command execution (notably via foomatic-rip). The researcher published technical details early; vendors are preparing patches. Because CUPS is typically not exposed to the public internet, Arctic Wolf assesses initial access risk as low but warns of realistic LAN lateral-movement exploitation; recommended mitigations include applying vendor patches, disabling cups-browsed if not needed, blocking outbound port 631, and inventorying devices listening on port 631.