CVE-2026-64612

HighCVSS 7.5

Published: 20/07/2026(UTC)Updated: 24/08/2026(UTC)Translated: 22/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.38%

31th percentile - higher than 31% of all known CVEs

Summary

The libcupsfilters and cups-filters libraries lack an error recovery handler when reading PNG files. An attacker can send a crafted PNG print job, causing the print job processing to abort.

Risk Assessment

An unauthenticated attacker can disrupt a print job, leading to denial of service for that job.

Recommendation

Update libcupsfilters and cups-filters to a version that includes proper PNG error handling.

Other vulnerabilities in libcupsfilters

CVE-2026-64611High
In the libcupsfilters library, the cfIEEE1284NormalizeMakeModel() function enters an infinite loop when processing an IEEE-1284 device ID with an empty model field. A network-adjacent attacker can broadcast a crafted printer advertisement, causing denial of service.

Original NVD description (English source)

A flaw was found in libcupsfilters and cups-filters. The PNG image reading function creates a libpng reader without installing an error recovery handler, causing the CUPS image filter process to abort when processing a malformed PNG file. An unauthenticated attacker could exploit this by submitting a specially crafted PNG print job, leading to denial of service of the in-flight print job.