Security researcher Simone Margaritelli disclosed a chained remote code execution flaw in the OpenPrinting Common UNIX Printing System (CUPS) affecting major Linux distributions. The entry vector, tracked as CVE-2026-47176 in cups-browsed (<= 2.0.1), binds unauthenticated to UDP port 631 (INADDR_ANY) and implicitly trusts packets from any remote source. A remote attacker sends a crafted packet referencing a rogue Internet Printing Protocol (IPP) URL, coercing cups-browsed into issuing an outbound Get-Printer-Attributes request and installing an attacker-controlled print queue.

The exploit completes by chaining input validation defects in libcupsfilters (CVE-2026-47076) and libppd (CVE-2026-47175), which accept unsanitized IPP attributes into temporary PostScript Printer Description (PPD) files. When a print task initiates, cups-filters (CVE-2026-47177) parses the malicious FoomaticRIPCommandLine directive, executing arbitrary shell commands with lp service privileges. Canonical, Red Hat, and SUSE have coordinated emergency remediation; administrators are advised to disable cups-browsed and drop ingress UDP 631 traffic.

Why it matters:

• Technical & Architecture Risk: Unauthenticated UDP daemon binding coupled with automatic outbound IPP fetching bypasses perimeter firewalls and ingress NAT boundaries, converting untrusted remote packets directly into unsanitized PostScript directives that achieve code execution without requiring administrative privileges.
• Strategic & Defender Imperative: Enterprise defenders must immediately verify whether cups-browsed is active on exposed Linux servers and developer workstations, disable the daemon via systemctl disable cups-browsed, block UDP port 631 at network perimeters, and apply vendor security updates as packages roll out.