A user in the lpadmin group can use the cups web ui to change the config and insert a malicious line.
Then the cupsd process which runs as root will parse the new config and cause an out-of-bound write.