Owning Internet Printing - A Case Study in Modern Software Exploitation

Summary: Project Zero published a full exploit chain for two CUPS bugs: CVE-2015-1158, a reference-count over-decrement in cupsd string handling that lets an attacker free an arbitrary global string, and CVE-2015-1159, a cross-site scripting bug in the CUPS templating engine. Together they let an attacker dismantle the ACLs protecting privileged operations, upload a replacement configuration file, and run arbitrary code, requiring only the basic ability to print and reachable in default Linux configurations.
What's compelling: The exploit is near-deterministic and unaffected by traditional exploit mitigations, and the XSS bypasses the default setting that binds the CUPS scheduler to localhost - so a printing service most organizations treat as internal was reachable from a browser.

Read the original at Google Project Zero ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2015-1158 CVE-2015-1159
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026