CVE-2026-64612 - libcupsfilters and cups-filters Denial of Service

CVE-2026-64612 is a denial-of-service vulnerability found in the libcupsfilters and cups-filters components of the Common Unix Printing System (CUPS). The flaw originates from the PNG image reading function, which fails to install an error recovery handler for the libpng library. This oversight allows an unauthenticated attacker to trigger a crash in the CUPS image filter process. By submitting a specially crafted malformed PNG file as a print job, an attacker can cause the process handling the print job to abort, effectively preventing that specific print job from completing and potentially impacting the overall availability of printing services. This vulnerability carries a CVSS v3.1 base score of 7.5, indicating a high severity due to its unauthenticated nature and direct impact on service availability.

Attack Chain

1. An unauthenticated attacker prepares a specially crafted PNG image file designed to exploit a missing error recovery handler within libpng.
2. The attacker submits this malformed PNG file as a print job to a vulnerable CUPS server.
3. The CUPS server initiates the image filter process, which uses libcupsfilters and cups-filters to handle the PNG print job.
4. During the processing of the malformed PNG, the libpng reader encounters an error.
5. Due to the absence of an error recovery handler, the libcupsfilters process aborts unexpectedly.
6. The in-flight print job fails, resulting in a denial of service for that specific job and potentially affecting the stability of the CUPS printing environment.

Impact

Successful exploitation of CVE-2026-64612 leads to a denial of service for print jobs on affected CUPS servers. An unauthenticated attacker can repeatedly submit malicious PNGs, causing the CUPS image filter processes to crash and rendering the printing service unreliable or unavailable for legitimate users. This can disrupt business operations that rely heavily on printing capabilities, such as those in corporate, educational, or government sectors. While the vulnerability primarily affects individual print jobs, persistent exploitation could necessitate manual intervention to restart services or clear queues, leading to operational downtime and productivity loss.

Recommendation

• Apply available patches from OpenPrinting for libcupsfilters and cups-filters to address CVE-2026-64612 immediately.
• Monitor CUPS server logs for frequent process crashes or unexpected termination of image filter processes, which could indicate attempted exploitation of CVE-2026-64612.
• Ensure that operating system and application logging for CUPS services are enabled and configured to capture error conditions.