cups2root: New CUPS Zero-Day Escalates lpadmin to Root

A newly released proof-of-concept called cups2root chains several CUPS configuration and privilege-boundary flaws to open an interactive root shell from an ordinary lpadmin account on Ubuntu Linux. Security researcher Rick de Jager of the V12 security team discovered the flaw and named it cups2root.

There is no CVE assigned at the time of writing, nor any advisory or patch from the vendor. cups2root is a local privilege escalation — the attacker must already sit in the lpadmin group, but from there it reaches full root code execution.

How cups2root Works

The researcher has already published the PoC code on GitHub, and the chain hinges on one quirk: the CUPS serial backend runs as root. cups2root creates a raw serial “printer” whose device points at /etc/cups/cups-files.conf; the print data then overwrites that config from a fixed byte offset, redirecting ServerBin and related paths into /etc/cups/interfaces.

The exploit then sends a malformed IPP subscription request, crashing the daemon. systemd restarts CUPS with the tampered config, leaving the interfaces directory writable by the attacker’s group. The attacker drops a replacement cups-exec binary there, which CUPS executes as root — installing a setuid shell before restoring the original files. The PoC targets Ubuntu 26.04 LTS on AMD64 and ARM64.

Why AppArmor Doesn’t Stop It

cups2root reaches root without ever leaving the sandbox, and every write it depends on — editing cups-files.conf, then filling the interfaces directory — is something Ubuntu’s AppArmor profile already permits cupsd to do. The exploit turns those allowed writes into root execution instead of breaking out. That matters: “run CUPS under a hardened AppArmor policy” was the standard advice for the earlier 2026 CUPS bugs, and cups2root is built to pass straight through it.

The April 2026 CUPS Chain

This is the second serious CUPS escalation to surface in 2026. In April, researcher Asim Manizada chained CVE-2026-34980 and CVE-2026-34990 to move from an unauthenticated network print job to arbitrary root file writes — overwriting /etc/sudoers.d/, say — with no user interaction. That chain began remotely; cups2root instead escalates a local account.

What To Do Now

With no patch available, the defence falls to configuration: restrict lpadmin membership to trusted administrators, disable the serial backend where it is not needed, and keep CUPS bound to localhost. Watch OpenPrinting for a fixed release and apply it as soon as it ships.