Summary

A user in the lpadmin group can use the cups web ui to change the config and insert a malicious line.
Then the cupsd process which runs as root will parse the new config and cause an out-of-bound write.

Details

The function get_addr_and_mask parses incorrectly ipv6 addresses.
Then in the code scheduler/conf.c:1897 :

if (i & 1)
   ip[i / 2] |= ipval;
else
   ip[i / 2] |= ipval << 16;

The attacker can make i be whatever negative value he wants, and ipval whatever hex number he wants.
We can control i with the number of : in the ipv6 address. There seems to be no limit to the number of : we can use.
And we control ipval with the actual numbers in the ipv6 address.
The out-of-bounds write isn't a single write, as all the numbers in the ipv6 address will be written.

PoC

1. Create a linux machine. I used Ubuntu 24.04.2 LTS
2. Create a user and add it to lpadmin group.
3. build the cups with address sanitizers

CC=clang CXX=clang++ CFLAGS="-fsanitize=address -g -O1" CXXFLAGS="-fsanitize=address -g -O1" LDFLAGS="-fsanitize=address" ./configure
make -j$(nproc)
make install

4. In a <Location /> tag of the cupsd.conf add the malicious ipv6 address.

Allow from [::2:3:6:9:c:::::::::::::4::::::::::::::::::::::3

5. run ./cupsd -c /path/to/malicious/cupsd.conf -t

While debugging the poc, you can see that the attacker can completely control the i and ipval values.

Impact

A user in lpadmin group can do cause cupsd to do a stack based out-of-bound write.
This can potentially cause Dos or privilege escalation.
If the config allows us to control the cupsd.conf of remote machine's via the UI, this can potentially cause an RCE.