CUPS Local Privilege Escalation QVD-2026-70361 Rated High

QiAnXin CERT on 17 September 2026 published an alert for a CUPS local privilege escalation tracked as QVD-2026-70361 with a CVSS 3.1 score of 7.8. Affected builds include Ubuntu 26.04 LTS cups 2.4.16-1ubuntu1.3 and cups-filters 2.0.1-0ubuntu4.1; no vendor patch was available as of 18 September 2026.

Overview

QiAnXin CERT reported a CUPS local privilege escalation tracked as QVD-2026-70361. The public date is 17 September 2026. QiAnXin rates it high, CVSS 3.1 score 7.8, threat type privilege escalation, exploit likelihood high. Public proof-of-concept code and technical details are available. No in-the-wild use had been found. QiAnXin estimated impact on the order of 100,000 systems.

CUPS is the OpenPrinting print system used as the common print service on Linux and Unix. Components include the cupsd scheduler, the filter and backend framework, and a web admin interface. cups-filters supplies backends such as serial and parallel. cupsd often runs as root on desktops, multi-user hosts, shared development machines, CI runners, and print servers.

A local user in the lpadmin group can obtain a root shell and full host control, including reading or changing data, installing persistence, and moving laterally. Conditions listed by QiAnXin: a local account in lpadmin, systemd, an active local CUPS service, and a privileged serial backend running as root.

Affected versions

Ubuntu 26.04 LTS with cups 2.4.16-1ubuntu1.3 and cups-filters 2.0.1-0ubuntu4.1. The public proof-of-concept states support for AMD64 and ARM64. Other Ubuntu and Debian releases that use systemd, a local CUPS service, a privileged serial backend, and standard Ubuntu CUPS paths may also be affected.

Asset exposure

QiAnXin Eagle Map counted 30,511 related at-risk assets in China and 28,139 related IPs.

Globally it counted 183,759 related at-risk assets and 179,797 related IPs.

Patching and mitigation

As of 18 September 2026, OpenPrinting and distributions had not published a security advisory, CVE, or patch. Watch:

https://github.com/OpenPrinting/cups/security/advisories

https://github.com/OpenPrinting/cups-filters/security/advisories

Apply updates as soon as they appear.

Until then:

1. Audit lpadmin membership and keep only trusted administrators (getent group lpadmin). 2. On hosts that do not need serial printing, remove the cups-filters serial backend. If it must remain, restrict cupsd writes to /etc/cups and /etc/cups/interfaces with mandatory access control such as AppArmor. 3. Review print queues and device URIs (lpstat -v, printers.conf) and delete unexpected serial backends or URIs that point into CUPS configuration directories.