CUPS cups-browsed RCE Chain: Real, but Needs a Print Job

What to do

1. Check whether cups-browsed runs: systemctl status cups-browsed
2. If you do not need network printer discovery, stop and disable it: sudo systemctl disable --now cups-browsed
3. If you need it, set BrowseRemoteProtocols none (or remove 'cups') in /etc/cups/cups-browsed.conf and restart
4. Block inbound UDP 631 at host and perimeter firewalls
5. Install your distribution's CUPS-related security updates

How to check if you are affected or compromised

• Run sudo ss -lunp | grep 631 to see if anything listens on UDP 631
• Check lpstat -v and the CUPS web UI for printers you did not add
• Look in /etc/cups/ppd/ for PPD files containing FoomaticRIPCommandLine or cupsFilter2 lines pointing at foomatic-rip with shell commands
• Review logs for unexpected processes spawned by the lp user

What happened#

On September 26, 2024, researcher Simone Margaritelli published an unauthenticated remote code execution chain in the OpenPrinting CUPS stack used by most Linux distributions. The disclosure was preceded by days of speculation about a "9.9" Linux bug, a score he says was an early estimate he would not have chosen himself.

The chain, per the CVE records and OpenPrinting advisories:

• CVE-2024-47176 (cups-browsed <= 2.0.1): the daemon binds to UDP 631 on all interfaces and trusts any packet, so one datagram makes it fetch printer attributes from an attacker URL.
• CVE-2024-47076 (libcupsfilters): returned IPP attributes are not sanitized.
• CVE-2024-47175 (libppd): those attributes are written unsanitized into a generated PPD file.
• An injected foomatic-rip filter line then runs attacker commands when a job is printed. This last link was filed as CVE-2024-47177, which was rejected in May 2025 as a duplicate of the other three.

Scores vary widely: 5.3 for CVE-2024-47176, 8.6 from GitHub for the library bugs, and 9.8 from NVD for CVE-2024-47175.

Who is affected#

Systems running cups-browsed with UDP 631 reachable: many Linux desktop installs, some BSDs, and others the researcher listed. Margaritelli reported callbacks from hundreds of thousands of internet hosts during weeks of scanning. Red Hat's RHSB-2024-002 rated it Important and said the shipped configuration is vulnerable but the service is disabled by default on RHEL. Typical cloud servers and containers do not run cups-browsed.

Do you really need to act?#

Mostly no, with two real caveats. The hype did not match the preconditions. A packet alone only plants a rogue printer; code runs when a user or system prints to it, and it runs as the unprivileged lp user, per Red Hat. There is no confirmed in-the-wild exploitation, and none of these CVEs are in CISA KEV as of October 21, 2026. A LAN attacker can reach the same path via mDNS/DNS-SD spoofing, which matters more for laptops on shared Wi-Fi.

The caveats. First, the researcher notes the rogue printer is added silently, with no user notification, so "the user must print" is weaker than it sounds on a desktop. Second, Akamai showed that the same single-packet behavior turns exposed hosts into DDoS reflectors: of more than 198,000 responding devices, over 58,000 were abusable, with about 600x average amplification and a few hundred looping endlessly. That is tracked as CVE-2024-47850 (cups-browsed before 2.5b1). If your hosts answer UDP 631 on the internet, you are someone else's attack infrastructure.

What to do now#

1. Check: systemctl status cups-browsed and sudo ss -lunp | grep 631.
2. Not printing to network-discovered printers? sudo systemctl disable --now cups-browsed, or remove the package.
3. Need it? Set BrowseRemoteProtocols none in /etc/cups/cups-browsed.conf and restart, as the OpenPrinting advisory and Red Hat recommend. A value including cups is vulnerable.
4. Block inbound UDP 631 at host and perimeter firewalls.
5. Apply distribution updates for cups-browsed, libcupsfilters, libppd and cups-filters.

How to tell if you were hit#

List printers with lpstat -v and remove any you do not recognize. Inspect PPD files under /etc/cups/ppd/ for FoomaticRIPCommandLine or filter lines invoking foomatic-rip with shell commands. Review logs for unexpected processes run by the lp user. For DDoS abuse, Akamai suggests watching for HTTP POSTs to /printers/ or /classes/ with a CUPS/ User-Agent and application/ipp content type.

Timeline#

• Sep 5, 2024 — Researcher reports issues to OpenPrinting.
• Sep 26, 2024 — Public disclosure, CVEs and advisories published.
• Oct 1, 2024 — Akamai publishes DDoS amplification research.
• May 12, 2025 — CVE-2024-47177 rejected as a duplicate.

Vulnerability records

• CVE-2024-47176 · CUPS is a standards-based, open-source printing system, and `cups-browsed` contains network printing functionality including, but not limited to…
• CVE-2024-47076 · CUPS is a standards-based, open-source printing system, and `libcupsfilters` contains the code of the filters of the former `cups-filters` package as library…
• CVE-2024-47175 · CUPS is a standards-based, open-source printing system, and `libppd` can be used for legacy PPD file support.
• CVE-2024-47850 · CUPS cups-browsed before 2.5b1 will send an HTTP POST request to an arbitrary destination and port in response to a single IPP UDP packet requesting a printer…

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. OpenPrinting — cups-browsed advisory GHSA-rj88-6mr5-rcw8 github.com
2. CVE.org — CVE-2024-47176 record cve.org
3. NVD — CVE-2024-47175 nvd.nist.gov
4. CVE.org — CVE-2024-47177 (rejected as duplicate) cve.org
5. Simone Margaritelli (evilsocket) — Attacking UNIX Systems via CUPS, Part I evilsocket.net
6. Red Hat — RHSB-2024-002 OpenPrinting cups-filters access.redhat.com
7. Akamai Security Research — CUPS DDoS threat (October 2024) akamai.com
8. CVE.org — CVE-2024-47850 record cve.org