PAPPL Raster Bug Enables Unauthenticated Remote Code Execution on Linux Print Servers

On September 10, 2026, Trend Micro's Zero Day Initiative published advisory ZDI-26-656, coordinated with a patch release from the PAPPL project. The vulnerability enables unauthenticated remote code execution on print servers running the framework with the allow_remote option enabled. The bug lies in the _papplJobProcessRaster() function, at the core of PWG/Apple raster document parsing, and is caused by an elementary mismatch between the attacker-controlled input size and the destination heap buffer size.

The Bug Mechanism: When Input Exceeds the Output Buffer

The _papplJobProcessRaster() function reads PWG/Apple raster documents directly from the client connection. When the printer output is configured for 1-bit, the dithering loop iterates over header.cupsWidth — an attacker-controlled, unbounded value — writing the result into 'line', a heap buffer allocated with size options->header.cupsBytesPerLine.

The trigger condition is linear: when cupsWidth exceeds cupsBytesPerLine, the for loop continues writing past the buffer boundary. No intermediate bounds check exists. The GitHub Security advisory, reference GHSA-p9wg-4p56-7xp6, documents the exact path: ipp_print_job → _papplJobCopyDocumentData → _papplJobProcessRaster, with _papplClientProcessHTTP and _papplClientRun in the execution path.

"The dithering loop iterates over the input image width (header.cupsWidth, attacker-controlled and unbounded) while writing the packed result into line, a heap buffer sized for the output line (options->header.cupsBytesPerLine)."

The technical analysis includes the full AddressSanitizer output: a heap-buffer-overflow error at address 0x7909d5df7d86, corresponding to 0 bytes past the allocated 102-byte region [0x7909d5df7d20,0x7909d5df7d86). The version tested by the researcher is identified by commit 69758fba7ebad98eb9e6113bdcd3fbcc4580fca3.

From Local LPE to Remote RCE: Two Attack Surfaces

The same flaw presents two faces. In a local configuration, the impact is LPE — Local Privilege Escalation — against PAPPL-based processes that typically run as root, reachable via Unix domain socket. In a remote configuration, with allow_remote=true, the same execution chain becomes an unauthenticated RCE vector.

The distinction matters for actual risk: many Linux distributions and embedded systems configure PAPPL with remote access for centralized printer management. The underlying IPP protocol requires no authentication in this mode for print job processing, leaving the attack surface open.

Advisory ZDI-26-656 explicitly states: "Authentication is not required to exploit this vulnerability." The reference to typical execution as root amplifies the consequences of a successful compromise, although the dossier does not document specific deployment configurations.

Coordinated Disclosure and the Patch

The vulnerability was reported to the vendor on August 4, 2026. Coordinated publication occurred on September 10, 2026, with the concurrent release of an update by PAPPL. The researcher operated anonymously, with credit attributed to "Anonymous working with Trend Micro Zero Day Initiative."

ZDI applies a standard deadline of approximately 120 days for vendor remediation from the report date. In this case, the actual interval was approximately 37 days, indicating a rapid response from the project. No details on the specific patch contents emerge from available sources.

It remains undocumented whether a CVE was assigned separately or if publication occurs exclusively via the ZDI identifier. No source in the dossier reports a CVSS score or specific affected PAPPL versions beyond the tested commit.

Why This Matters

PAPPL represents the evolutionary line replacing CUPS in many modern Linux distributions and embedded systems for printers and MFPs. As the reference framework for OEMs and cloud print service providers, its exposure typically occurs in infrastructure layers considered low-risk — "just printing" — with consequent underinvestment in segmentation controls.

The dossier does not specify the nature of data exposed on vulnerable systems, nor does it document the presence of exploits in the wild. The brief lists no specific remedial measures beyond the vendor-released update. The actual distribution of the patch across various Linux distributions is not verified in the sources.

It remains to be verified whether distributions have already integrated the update into their respective repositories, and in which versions. No infrastructure overlaps linking this vulnerability to other bugs in the same framework emerge at present.

The printer as an attack surface is a recurring but systematically neglected theme. The ability to turn a print job into code execution via a seemingly innocuous raster file demonstrates that parsing complexity remains fertile ground for high-severity vulnerabilities, even in modern, actively maintained software components.

Sources

• http://www.zerodayinitiative.com/advisories/ZDI-26-656/
• https://github.com/michaelrsweet/pappl/security/advisories/GHSA-p9wg-4p56-7xp6
• https://www.trendmicro.com/
• https://www.trendmicro.com/en_us/business/products/one-platform.html

Information verified against cited sources and current as of publication.

Sources