Cups-Filters - CraftedSignal Threat Feed

CUPS (libcupsfilters, cups-filters) Denial of Service Vulnerability

hello@craftedsignal.io — Tue, 21 Jul 2026 09:16:18 +0000

A recently disclosed vulnerability in the Common Unix Printing System (CUPS), affecting the libcupsfilters and cups-filters components, allows for a denial-of-service (DoS) attack. A remote, unauthenticated attacker can exploit this flaw by sending specially crafted input to a vulnerable CUPS server. The processing of this malicious input triggers a condition that exhausts resources, crashes the service, or otherwise renders the printing system inoperable. This vulnerability poses a risk to the availability of printing services on systems utilizing CUPS, which is a common component in Linux and Unix-like environments. The precise technical details of the vulnerability, such as specific input vectors or trigger conditions, have not been publicly detailed.

Attack Chain

A remote, unauthenticated attacker identifies an internet-accessible or network-accessible CUPS server running a vulnerable version.
The attacker crafts and sends malicious network requests or malformed print job data targeting the CUPS service.
The CUPS server processes the malformed input, specifically engaging the libcupsfilters or cups-filters components.
The inherent flaw within these filtering libraries is triggered, leading to abnormal behavior such as an infinite loop, excessive memory consumption, or a critical application crash.
The CUPS service becomes unresponsive or terminates abruptly, preventing legitimate print requests from being processed.
The consequence is a Denial of Service, rendering the entire printing system unavailable to users and applications connected to the affected server.

Impact

Successful exploitation of this vulnerability results in a Denial of Service condition for the affected CUPS server and any clients reliant on it for printing services. This can lead to significant operational disruption, as printing capabilities become unavailable. Depending on the organization's reliance on printing infrastructure, this could impede daily business operations, impact critical workflows, and cause productivity losses. While no specific victim numbers or targeted sectors are mentioned, any organization utilizing vulnerable CUPS installations is at risk.

Recommendation

Regularly monitor official CUPS project channels and your Linux distribution's security advisories for patches addressing this vulnerability.
Apply security updates for CUPS, libcupsfilters, and cups-filters as soon as they become available to mitigate the Denial of Service risk.
Restrict network access to CUPS servers to only trusted clients and necessary network segments to limit exposure to remote, unauthenticated attackers.

CVE-2026-64612 - libcupsfilters and cups-filters Denial of Service

hello@craftedsignal.io — Mon, 20 Jul 2026 18:18:31 +0000

CVE-2026-64612 is a denial-of-service vulnerability found in the libcupsfilters and cups-filters components of the Common Unix Printing System (CUPS). The flaw originates from the PNG image reading function, which fails to install an error recovery handler for the libpng library. This oversight allows an unauthenticated attacker to trigger a crash in the CUPS image filter process. By submitting a specially crafted malformed PNG file as a print job, an attacker can cause the process handling the print job to abort, effectively preventing that specific print job from completing and potentially impacting the overall availability of printing services. This vulnerability carries a CVSS v3.1 base score of 7.5, indicating a high severity due to its unauthenticated nature and direct impact on service availability.

Attack Chain

An unauthenticated attacker prepares a specially crafted PNG image file designed to exploit a missing error recovery handler within libpng.
The attacker submits this malformed PNG file as a print job to a vulnerable CUPS server.
The CUPS server initiates the image filter process, which uses libcupsfilters and cups-filters to handle the PNG print job.
During the processing of the malformed PNG, the libpng reader encounters an error.
Due to the absence of an error recovery handler, the libcupsfilters process aborts unexpectedly.
The in-flight print job fails, resulting in a denial of service for that specific job and potentially affecting the stability of the CUPS printing environment.

Impact

Successful exploitation of CVE-2026-64612 leads to a denial of service for print jobs on affected CUPS servers. An unauthenticated attacker can repeatedly submit malicious PNGs, causing the CUPS image filter processes to crash and rendering the printing service unreliable or unavailable for legitimate users. This can disrupt business operations that rely heavily on printing capabilities, such as those in corporate, educational, or government sectors. While the vulnerability primarily affects individual print jobs, persistent exploitation could necessitate manual intervention to restart services or clear queues, leading to operational downtime and productivity loss.

Recommendation

Apply available patches from OpenPrinting for libcupsfilters and cups-filters to address CVE-2026-64612 immediately.
Monitor CUPS server logs for frequent process crashes or unexpected termination of image filter processes, which could indicate attempted exploitation of CVE-2026-64612.
Ensure that operating system and application logging for CUPS services are enabled and configured to capture error conditions.