Vulnerability record · CVE-2024-47175 · published 26 September 2024
CVE-2024-47175: libppd fails to sanitize IPP attributes when building PPD, enabling RCE
Openprinting · Libppd
The libppd function ppdCreatePPDFromIPP2 does not sanitize IPP attributes when constructing a PPD buffer, allowing attacker-controlled input to reach downstream consumers such as Foomatic. It is a link in the CUPS exploit chain described in CVE-2024-47176 that can end in remote code execution.
Description
CUPS is a standards-based, open-source printing system, and `libppd` can be used for legacy PPD file support. The `libppd` function `ppdCreatePPDFromIPP2` does not sanitize IPP attributes when creating the PPD buffer. When used in combination with other functions such as `cfGetPrinterAttributes5`, can result in user controlled input and ultimately code execution via Foomatic. This vulnerability can be part of an exploit chain leading to remote code execution (RCE), as described in CVE-2024-47176.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Automated analysis
critical priorityCVSS 9.8 with network, unauthenticated, no-interaction vector and very high EPSS, plus public exploit references, make this a top remediation priority.
What it is
The libppd function ppdCreatePPDFromIPP2 does not sanitize IPP attributes when constructing a PPD buffer, allowing attacker-controlled input to reach downstream consumers such as Foomatic. It is a link in the CUPS exploit chain described in CVE-2024-47176 that can end in remote code execution.
Impact
An attacker can inject crafted IPP attribute content that is processed by Foomatic, potentially achieving code execution on the affected host.
Attack surface
Reachable over the network (CVSS AV:N, PR:N, UI:N) through IPP attribute handling in the CUPS/libppd printing path; no authentication or user interaction is required per the vector.
Exploitation
Not listed in CISA KEV, but EPSS is 0.63607 (99.177th percentile) and public references are tagged Exploit, indicating active interest and available proof-of-concept material.
What to do
- Apply the libppd patch commit d681747ebf12602cb426725eb8ce2753211e2477 and the corresponding OpenPrinting advisories for cups-browsed, cups-filters and libcupsfilters.
- Update Debian packages per the Debian LTS advisory for this issue.
- Disable or restrict cups-browsed and CUPS browsing where not required, and block IPP/UDP 631 exposure to untrusted networks.
- Remove or restrict Foomatic filters if legacy PPD support is not needed.
- Monitor vendor advisories (SonicWall, NetApp) for downstream product impact.
Detection
- Audit CUPS logs for unexpected IPP attribute values or malformed PPD generation events.
- Monitor for new or modified PPD files in /etc/cups/ppd and spool directories.
- Watch for Foomatic filter process execution with unusual arguments or parent processes.
- Alert on outbound or inbound IPP traffic on port 631 from untrusted sources.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2024-47175 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2024-47175), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
