Two Critical Vulnerabilities Found in PAPPL Affecting Local and Remote Code Execution
Article Content
- •Two critical vulnerabilities in PAPPL identified by Trend Micro's Zero Day Initiative.
- •ZDI-CAN-32306 allows local privilege escalation; ZDI-CAN-32307 enables remote code execution.
- •Both vulnerabilities have a 120-day remediation timeline before public advisories are issued.
Trend Micro's Zero Day Initiative has identified two significant vulnerabilities in the PAPPL printer software. The first, ZDI-CAN-32306, is a stack-based buffer overflow that allows local privilege escalation with a CVSS score of 7.8. The second, ZDI-CAN-32307, is a heap-based buffer overflow that enables remote code execution, rated at a CVSS score of 9.8. Both vulnerabilities affect the same version of PAPPL tested on Ubuntu 25.10. The vulnerabilities were discovered by an anonymous researcher and reported to the vendor, with a 120-day remediation timeline expected. If no patch is released within this period, Trend Micro will issue a limited public advisory with mitigations. The vulnerabilities pose a serious risk to users of PAPPL, particularly in environments where the software is deployed.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (2)
Following this threat?
Track Trend Micro in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Continue Reading
Critical RCE Vulnerability in Confection WordPress Plugin (CVE-2026-115252) A critical vulnerability, CVE-2026-115252, has been identified in the Confection WordPress Cable plugin, affecting versions 0.4.0 to 0.4.7. This flaw allows unauthenticated attackers to execute arbitrary PHP code on the server by writing unmodified settings into a PHP file without proper checks. The vulnerability has…