Small praise for modern compilers - A case of Ubuntu printing vulnerability that wasn’t

Summary: Cisco Talos audited the CUPS-based printing subsystem and found that Ubuntu 22.04's ippusbxd daemon has a stack-based buffer overflow in its parsing of printer-reported paper dimensions, triggerable when a USB-connected printer reports an oversized y-dimension. The team built a proof of concept on a Raspberry Pi Zero emulating a malicious USB printer via the Linux USB Gadget API and PAPPL, which caused a segmentation fault in ippusbxd, but the crash came from FORTIFY_SOURCE terminating the program before the overflow rather than from memory corruption.
Bottom line: The bug is real but not exploitable beyond a crash because compiler features - the -Wstringop-overflow warning and FORTIFY_SOURCE - caught and blocked it, and ippusbxd has been abandoned in favor of the memory-safe ipp-usb, leaving Ubuntu 22.04 LTS as the exception still shipping it.

Read the original at Cisco Talos ↗

Topics: Vulnerabilities & Patching
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026