libcupsfilters CVE-2026-64611

The concrete prerequisite is that a target host running libcupsfilters ingests a printer-advertised IEEE-1284 device ID in which the model (MDL) field is empty - that malformed, attacker-controlled advertisement IS the trigger, requiring no authentication and no user interaction (PR:N/UI:N). Exploitation is limited by proximity: the description specifies a network-adjacent attacker broadcasting the advertisement, so the attacker must be on the same broadcast domain / network segment (adjacent access) even though the CVSS vector states AV:N - this discrepancy should be verified with the vendor. It is further limited to systems that actually process advertised device IDs (e.g., hosts running CUPS printer discovery / cups-browsed); hosts with automatic printer discovery disabled or isolated from advertisement traffic are not reachable.

The published CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H yields 7.5 (High) and reflects a pure availability impact - no confidentiality or integrity loss. There is a notable conflict: the vector encodes AV:N (network) while the description explicitly says a 'network-adjacent attacker' broadcasting an advertisement, which is adjacent (AV:A) semantics - verify with the vendor, as adjacency meaningfully limits reach to the local broadcast domain. No EPSS score, no POC, and no KEV listing were provided, so despite the High base score this reads as a real-but-lower-priority issue: exploitation requires being on the same network segment and only degrades service rather than granting access. No SSVC decision data was supplied.

An attacker who has gained a foothold on the local network segment (for example a compromised workstation or IoT device) broadcasts a spoofed printer advertisement containing an IEEE-1284 device ID with an empty model field. When a nearby CUPS-based host processes the advertisement, cfIEEE1284NormalizeMakeModel() spins in an infinite loop and saturates a CPU, degrading or denying the printing service. No public POC was identified, and given AC:L the trigger is straightforward once the malformed advertisement is delivered.