What’s Vulnerable › Vulnerabilities

CVE-2026-64612: Libcupsfilters: cups-filters: libcupsfilters: cups image filter process abort via malformed png

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-07-20 · updated 2026-10-24
• Weakness: CWE-248

Description

A flaw was found in libcupsfilters and cups-filters. The PNG image reading function creates a libpng reader without installing an error recovery handler, causing the CUPS image filter process to abort when processing a malformed PNG file. An unauthenticated attacker could exploit this by submitting a specially crafted PNG print job, leading to denial of service of the in-flight print job.

Affected products

• Red Hat Enterprise Linux 10: all versions — fixed in 1:2.0.0-13.el10_2
• Red Hat Enterprise Linux 8: all versions — fixed in 0:1.20.0-36.el8_10.1
• Red Hat Enterprise Linux 9: all versions — fixed in 0:1.28.7-27.el9_8

How to fix

Upgrade to a fixed version: Red Hat Enterprise Linux 10 1:2.0.0-13.el10_2; Red Hat Enterprise Linux 8 0:1.20.0-36.el8_10.1; Red Hat Enterprise Linux 9 0:1.28.7-27.el9_8. Check the vendor advisory for mitigations.

References

• https://access.redhat.com/errata/RHSA-2026:56965
• https://access.redhat.com/errata/RHSA-2026:57451
• https://access.redhat.com/errata/RHSA-2026:58560
• https://access.redhat.com/security/cve/CVE-2026-64612
• https://bugzilla.redhat.com/show_bug.cgi?id=2502801
• https://github.com/OpenPrinting/libcupsfilters/security/advisories/GHSA-7mxj-cfq5-84ch

Get alerted when CVE-2026-64612 or the next vulnerability affects your stack