A critical privilege escalation vulnerability in the CUPS printing system allows local attackers with administrative print rights to achieve full root-level code execution.

This flaw exists due to improper privilege management in the CUPS scheduler, which fails to restrict non-file device URIs. An attacker who is already a member of the lpadmin group can leverage the root-privileged serial backend to write arbitrary data to system files, leading to a complete system compromise.

The potential for root-level code execution poses a severe risk to organizational infrastructure, as it allows attackers to bypass security boundaries, install persistence mechanisms, and exfiltrate sensitive data. With a CVSS score of 8.2, this vulnerability is classified as high severity, particularly because it enables full control over the compromised host. The ability to modify security-sensitive configurations ensures that an attacker could effectively disable existing security controls once elevated.

Immediate Action: Monitor the Red Hat security advisory portal for the release of official patches and apply them to all affected Red Hat Enterprise Linux systems as soon as they become available.

Proactive Monitoring: Audit current memberships of the lpadmin group to ensure that only authorized administrative users possess these privileges. Review system logs for unusual printer configuration changes or unexpected execution of backend binaries.

Compensating Controls: Restrict access to the CUPS scheduler and enforce strict user privilege policies to minimize the number of accounts with administrative printing rights. Ensure that systems are configured to follow the principle of least privilege, limiting the potential impact of local account compromise.

Public Exploit Available: Yes, a public proof-of-concept exists via the research write-up referenced in the CVE record.

Given the potential for complete system compromise via root code execution, this vulnerability requires urgent attention. IT teams should immediately review user access controls to minimize the attack surface and prepare for the deployment of vendor-supplied patches as soon as they are released by Red Hat.