High Severity
CVE-2026-34990
Published: Oct 25, 2026
Generic PoC for CVE-2026-34990 - CUPS 2.4.16 Local Privilege Escalation via Local token disclosure and arbitrary root file overwrite.
# CVE-2026-34990 | CUPS Local Privilege Escalation PoC
A generic proof-of-concept for **CVE-2026-34990**, a local privilege escalation vulnerability affecting CUPS 2.4.16.
The exploit demonstrates how a local unprivileged user can abuse CUPS local authentication and printer configuration behavior to obtain an arbitrary file write as `root` and escalate privileges.
## Vulnerability
- **CVE:** CVE-2026-34990
- **Component:** CUPS
- **Tested Version:** CUPS 2.4.16
- **Type:** Local Privilege Escalation
- **Impact:** Arbitrary file write as root
- **Fixed Version:** CUPS 2.4.17
## Vulnerability Credit
CVE-2026-34990 was originally reported by:
**Asim Viladi Oglu Manizada (@manizada)**
I am **not the discoverer of this vulnerability**.
This repository contains my adapted and tested proof-of-concept implementation based on publicly disclosed technical information.
## How It Works
At a high level, the exploit chain is:
```text
Local unprivileged user
|
v
Create temporary CUPS printer
|
v
Trigger outbound IPP authentication
|
v
Capture Authorization: Local token
|
v
Reuse token against privileged CUPS operations
|
v
Create/persist file:// printer
|
v
Submit print job
|
v
Root-owned arbitrary file write
|
v
Privilege escalation
```
The PoC uses the current local username automatically.
For example, when executed as:
```text
alice
```
the demonstration payload targets:
```text
/etc/sudoers.d/alice-pwn
```
and attempts to write:
```text
alice ALL=(ALL) NOPASSWD: ALL
```
A successful exploit can then be verified with:
```bash
sudo -n id
```
Example:
```text
uid=0(root) gid=0(root) groups=0(root)
```
## Requirements
The PoC expects:
- Linux
- Python 3
- Vulnerable CUPS installation
- `ipptool`
- `lp`
- `lpstat`
- Local access to the CUPS scheduler
Check the CUPS version:
```bash
cups-config --version
```
Check that the sched