This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.

[TLP:CLEAR] OpenPrinting fixes 2 vulnerabilities in CUPS components

OpenPrinting fixes 2 lower-severity vulnerabilities in components of the CUPS printing system (libcupsfilters, cups-filters). The fixes are available as commits, a list of which can be found at [1][2]. Fixed versions are not available for the stable releases of common Linux distributions such as Debian, Ubuntu or SUSE [3][4][5][6][7][8].

libcupsfilters, cups-filters - out-of-bounds read/write (CVE-2025-57812)
CVSS 3.7 (Low)

By sending a print job containing a specially crafted TIFF file, an authenticated attacker in an adjacent network can, under certain conditions, read data beyond the boundary of allocated memory or write to it without authorization [1][9].

The vulnerability is present in products:

  • cups-filters; <=1.28.17;
  • libcupsfilters; >=2.0.0, <2.1.1;

CVSS: CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

More information:

The vulnerability was publicly disclosed 12. 11. 2025.

libcupsfilters, cups-filters - process crash (CVE-2025-64503)
CVSS 4.0 (Medium)

Due to an out-of-bounds write in the pdftoraster tool, an unauthenticated local attacker can cause a process crash by means of a specially crafted PDF file [2][10].

The vulnerability is present in products:

  • cups-filters; <1.28.18;
  • libcupsfilters; >=2.0.0, <2.1.2;

CVSS: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

More information:

The vulnerability was publicly disclosed 12. 11. 2025.

By CESNET, z.s.p.o. Michaela Ručková on 20. 11. 2025.

CESNET, z.s.p.o. Logo