libcupsfilters EUVD-2026-46046

The attacker must be able to submit a PNG print job to a CUPS queue that routes through the libcupsfilters/cups-filters PNG image filter - i.e. PNG-to-raster conversion must be an accepted input path on the target queue. The single hard prerequisite is a malformed PNG that libpng flags as an error; no authentication is asserted by the CVSS vector (PR:N/UI:N). Exploitation is LIMITED by print-queue reachability: it is only unauthenticated-remote where cupsd accepts network job submission without auth - on localhost-only or authenticated queues the attacker needs local access or valid credentials. Impact is further limited to aborting the individual in-flight job rather than crashing the CUPS daemon or host.

The published CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H yields 7.5 (High) by rating availability impact as High with no confidentiality or integrity impact - consistent with a pure DoS. However, the description explicitly limits the effect to 'denial of service of the in-flight print job,' i.e. a single job is aborted rather than the CUPS scheduler or host being taken down, which suggests the real availability impact is closer to A:L than A:H; the 7.5 rating is likely conservative-high relative to actual blast radius. There is no CISA KEV listing and no POC referenced, so exploitation is neither confirmed active nor publicly demonstrated. EPSS and SSVC data were not provided. The AV:N/PR:N assumption also depends on the CUPS instance accepting print jobs over the network without authentication; on hosts where printing is local-only or authenticated, the practical attack vector narrows to local. Overall this is a low-consequence availability bug that is easy to trigger but hard to weaponize beyond nuisance job disruption.

An attacker with the ability to send print jobs to a CUPS queue crafts a PNG file that libpng will reject during decode and submits it as a print job over IPP. The image filter loads the PNG without an error handler, libpng's fatal path aborts the filter process, and the victim's print job fails; repeated submissions can be used to persistently disrupt printing. No POC is referenced, and the low attack complexity (AC:L) means no special timing or configuration beyond queue access is required.