Denial of Service in CUPS Filters via Malformed PNG

Executive Summary

CVE-2026-64612 is a denial-of-service vulnerability in libcupsfilters and cups-filters. The PNG image reading functions fail to set an error recovery handler, causing the CUPS image filter process to abort when processing a malformed PNG file. This leads to a crash of the print job processing filters.

Useful 0 Not Useful 0

Detection Guidance

Check if your system uses vulnerable versions of libcupsfilters (2.1.1 or earlier) or cups-filters (1.28.17 or earlier) by running version checks on related packages. Monitor CUPS filter processes for crashes when processing PNG files, as crashes may indicate exploitation attempts.

Useful 0 Not Useful 0

Impact Analysis

An unauthenticated attacker could exploit this by sending a specially crafted PNG file as part of a print job. This would cause the affected CUPS filter process to crash, resulting in the denial of service for that specific print job.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability primarily causes denial of service by crashing print jobs, which does not directly impact data confidentiality or integrity required by standards like GDPR or HIPAA. However, service disruption could indirectly affect compliance if critical print operations are interrupted.

Useful 0 Not Useful 0

Mitigation Strategies

Avoid processing untrusted PNG files through CUPS. Temporarily disable or restrict PNG image handling in print jobs if possible. Monitor for crashes in CUPS filter processes and apply updates once a patch is released.

Useful 0 Not Useful 0