Critical CUPS Vulnerability Chain Enables Remote Root Access Security researchers led by Asim Viladi Oglu Manizada have uncovered a pair of zero-day vulnerabilities in the Common Unix Printing System (CUPS), tracked as CVE-2026-34980 and CVE-2026-34990, which allow unauthenticated remote attackers to execute arbitrary code with root privileges. The flaws affect CUPS versions 2.4.16 and older, posing a severe risk of full system compromise. The attack exploits a two-stage chain, beginning with CVE-2026-34980, which targets CUPS’ default policy of accepting anonymous print jobs on exposed shared PostScript queues. By sending a maliciously crafted print request containing embedded newline characters, attackers bypass authentication and inject malicious commands into the scheduler’s control records. This grants remote code execution (RCE) as the unprivileged "lp" user. The second flaw, CVE-2026-34990, enables privilege escalation to root. Attackers exploit CUPS’ policy allowing low-privilege accounts to create temporary local printers without admin approval. By intercepting the setup process, they steal a reusable local authorization token, then manipulate a race condition to overwrite system files, achieving arbitrary root file access. As of early April 2026, no official patches are available. The initial RCE requires exposed shared PostScript queues, a deliberate configuration choice. Mitigation strategies include disabling legacy queues, restricting CUPS network exposure, enforcing strict authentication, and deploying mandatory access controls (AppArmor/SELinux) to limit damage from compromised processes.