Skip to main content

libcupsfilters CVE-2026-64611

| EUVDEUVD-2026-47973 HIGH
Loop with Unreachable Exit Condition (Infinite Loop) (CWE-835)
2026-07-23 redhat GHSA-m7r8-8qc5-j4jf
7.5
CVSS 3.1 · Vendor: redhat
Share

Severity by source

Vendor (redhat) PRIMARY
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
6.5 MEDIUM

Description specifies a network-adjacent broadcast so AV:A rather than AV:N; no auth or interaction (PR:N/UI:N), and impact is availability-only CPU exhaustion (A:H, C/I:N).

3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
6.5 MEDIUM
AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Red Hat
7.5 MEDIUM
qualitative

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

2
Analysis Generated
Jul 23, 2026 - 11:16 vuln.today
CVE Published
Jul 23, 2026 - 10:46 cve.org
HIGH 7.5

DescriptionCVE.org

A flaw was found in libcupsfilters. The cfIEEE1284NormalizeMakeModel() function enters an infinite loop when processing a printer-advertised IEEE-1284 device ID with an empty model field, causing sustained CPU consumption. A network-adjacent attacker could exploit this by broadcasting a specially crafted printer advertisement, leading to denial of service.

AnalysisAI

Denial of service in OpenPrinting libcupsfilters (as shipped in Red Hat Enterprise Linux 7 through 10) allows a network-adjacent attacker to pin a CPU at 100% by broadcasting a crafted printer advertisement. The flaw lies in cfIEEE1284NormalizeMakeModel(), which enters an infinite loop (CWE-835) when parsing an IEEE-1284 device ID whose model field is empty. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV; impact is limited to availability with no data compromise.

Technical ContextAI

libcupsfilters is the OpenPrinting filter library underpinning modern CUPS-based printing on Linux; it converts print data and processes device metadata discovered on the network. IEEE-1284 device IDs are the standardized key-value strings (MFG, MDL, CMD, etc.) that printers advertise to describe make and model. The helper cfIEEE1284NormalizeMakeModel() normalizes those strings; when the model (MDL) field is empty, its loop lacks a reachable exit condition - the classic CWE-835 'Loop with Unreachable Exit Condition' root cause - so parsing never terminates and the thread spins indefinitely, consuming CPU.

RemediationAI

Upstream fix available (OpenPrinting GHSA-rcq7-rv5g-j3r4); a released patched version was not independently confirmed from the provided data, so apply the updated libcupsfilters package for your RHEL stream as soon as Red Hat publishes it and track https://access.redhat.com/security/cve/CVE-2026-64611 for the exact errata version. As compensating controls until patched: restrict printer/network discovery by blocking mDNS/DNS-SD (UDP 5353) and other printer-advertisement traffic from untrusted segments at the switch or host firewall, and place print hosts on a dedicated VLAN so hostile advertisements cannot reach them - note this may break automatic printer discovery for legitimate clients. Where automatic discovery is not required, disabling cups-browsed / driverless discovery removes the code path that ingests advertised device IDs, at the cost of manual printer configuration.

CVE-2026-18663 MEDIUM
5.9 Aug 12

Heap corruption via double-free in 389-ds-base's LDAP control parsing allows an unauthenticated remote attacker to crash

CVE-2026-4631 CRITICAL POC
9.8 Apr 07

Remote code execution in Cockpit's web interface allows unauthenticated attackers to execute arbitrary commands on the h

CVE-2026-4480 CRITICAL POC
9.0 May 26

Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft

CVE-2026-18922 CRITICAL
9.8 Sep 07

Authentication bypass in 389 Directory Server (shipped as Red Hat Directory Server 11-13 and within RHEL 6-10) lets remo

CVE-2026-14544 CRITICAL
9.8 Jul 03

Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter

CVE-2026-76578 CRITICAL
9.8 Sep 07

Unauthenticated privilege escalation in FreeIPA (Red Hat Identity Management) allows a remote attacker to gain genuine a

CVE-2026-5121 HIGH
7.5 Mar 30

Remote code execution in libarchive on 32-bit systems allows unauthenticated attackers to execute arbitrary code via spe

CVE-2026-28369 CRITICAL
9.1 Mar 27

HTTP request smuggling in Undertow (the embedded web server underpinning JBoss EAP, Red Hat Data Grid, and Apache Camel

CVE-2026-28368 CRITICAL
9.1 Mar 27

HTTP request smuggling in Red Hat Undertow allows remote unauthenticated attackers to bypass front-end security controls

CVE-2026-33845 CRITICAL
9.1 Apr 30

Out-of-bounds read in the GnuTLS DTLS handshake reassembly logic lets remote unauthenticated attackers trigger an intege

CVE-2026-28367 CRITICAL
9.1 Mar 27

HTTP request smuggling in Undertow allows remote unauthenticated attackers to send `\r\r\r` as a header block terminator

CVE-2026-16526 HIGH
8.8 Jul 30

Local privilege escalation in Performance Co-Pilot (PCP) on Red Hat Enterprise Linux 6 through 10 and OpenShift Containe

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected
SUSE Linux Enterprise Module for Basesystem 15 SP7 Not-Affected
SUSE Linux Enterprise Server 15 SP7 Not-Affected
SUSE Linux Enterprise Server 16.0 Not-Affected

Share

CVE-2026-64611 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy