Skip to main content

libcupsfilters EUVDEUVD-2026-46046

| CVE-2026-64612 HIGH
Uncaught Exception (CWE-248)
2026-07-20 redhat GHSA-qfw8-cr83-3h6j
7.5
CVSS 3.1 · Vendor: redhat
Share

Severity by source

Vendor (redhat) PRIMARY
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.3 MEDIUM

Network-submittable crafted PNG needs no auth (PR:N) or interaction, but only the single in-flight print job aborts rather than the daemon, so A:L not A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
SUSE
5.3 MEDIUM
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Red Hat
7.5 MEDIUM
qualitative

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

2
Analysis Generated
Jul 20, 2026 - 18:18 vuln.today
CVE Published
Jul 20, 2026 - 17:33 cve.org
HIGH 7.5

DescriptionCVE.org

A flaw was found in libcupsfilters and cups-filters. The PNG image reading function creates a libpng reader without installing an error recovery handler, causing the CUPS image filter process to abort when processing a malformed PNG file. An unauthenticated attacker could exploit this by submitting a specially crafted PNG print job, leading to denial of service of the in-flight print job.

AnalysisAI

Denial of service in libcupsfilters and cups-filters (the OpenPrinting image-filtering stack bundled with Red Hat Enterprise Linux 7 through 10) allows an unauthenticated attacker to abort the CUPS image filter by submitting a specially crafted PNG print job. The PNG reader instantiates a libpng decoder without registering an error-recovery handler, so a malformed image triggers libpng's default fatal-error path and terminates the filter process, killing the in-flight print job. No public exploit identified at time of analysis; this is a print-job availability issue, not a code-execution or data-exposure flaw.

Technical ContextAI

The affected component is the PNG-reading code path in libcupsfilters/cups-filters, the filter layer that converts incoming print data (here, PNG raster images) into printer-ready output within the CUPS printing pipeline. Root cause is CWE-248 (Uncaught Exception): libpng requires the caller to supply an error callback (via png_create_read_struct or png_set_error_fn) so decode errors can be handled gracefully; when none is installed, libpng invokes its default handler which calls longjmp/abort and terminates the process. Because the filter runs the decode without that recovery handler, any malformed PNG that libpng rejects becomes a fatal abort of the filter process. Affected products per Red Hat CPE data are Red Hat Enterprise Linux 7, 8, 9, and 10 (cpe:2.3:a:red_hat:red_hat_enterprise_linux_7/8/9/10).

RemediationAI

No vendor-released patch version is identified in the provided data; Patch available per upstream advisory GHSA-7mxj-cfq5-84ch (https://github.com/OpenPrinting/libcupsfilters/security/advisories/GHSA-7mxj-cfq5-84ch) and tracked by Red Hat at https://access.redhat.com/security/cve/CVE-2026-64612 and https://bugzilla.redhat.com/show_bug.cgi?id=2502801 - apply the updated libcupsfilters/cups-filters packages once your distribution publishes them and restart cups. As a compensating control until patched, restrict who can submit print jobs: bind CUPS to localhost or trusted networks and require authentication in cupsd.conf (Listen localhost:631, Allow/Require valid-user on the printer policy), which prevents unauthenticated remote PNG submission but breaks open network printing. Where PNG printing is not needed, remove or disable the PNG input filter / MIME conversion so malformed PNGs are rejected before reaching the vulnerable reader, at the cost of losing direct PNG print support. Because impact is limited to a single aborted job with automatic process teardown, no data-loss cleanup is required after an attempt.

CVE-2026-18663 MEDIUM
5.9 Aug 12

Heap corruption via double-free in 389-ds-base's LDAP control parsing allows an unauthenticated remote attacker to crash

CVE-2026-4631 CRITICAL POC
9.8 Apr 07

Remote code execution in Cockpit's web interface allows unauthenticated attackers to execute arbitrary commands on the h

CVE-2026-4480 CRITICAL POC
9.0 May 26

Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft

CVE-2026-18922 CRITICAL
9.8 Sep 07

Authentication bypass in 389 Directory Server (shipped as Red Hat Directory Server 11-13 and within RHEL 6-10) lets remo

CVE-2026-14544 CRITICAL
9.8 Jul 03

Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter

CVE-2026-76578 CRITICAL
9.8 Sep 07

Unauthenticated privilege escalation in FreeIPA (Red Hat Identity Management) allows a remote attacker to gain genuine a

CVE-2026-5121 HIGH
7.5 Mar 30

Remote code execution in libarchive on 32-bit systems allows unauthenticated attackers to execute arbitrary code via spe

CVE-2026-28369 CRITICAL
9.1 Mar 27

HTTP request smuggling in Undertow (the embedded web server underpinning JBoss EAP, Red Hat Data Grid, and Apache Camel

CVE-2026-28368 CRITICAL
9.1 Mar 27

HTTP request smuggling in Red Hat Undertow allows remote unauthenticated attackers to bypass front-end security controls

CVE-2026-33845 CRITICAL
9.1 Apr 30

Out-of-bounds read in the GnuTLS DTLS handshake reassembly logic lets remote unauthenticated attackers trigger an intege

CVE-2026-28367 CRITICAL
9.1 Mar 27

HTTP request smuggling in Undertow allows remote unauthenticated attackers to send `\r\r\r` as a header block terminator

CVE-2026-16526 HIGH
8.8 Jul 30

Local privilege escalation in Performance Co-Pilot (PCP) on Red Hat Enterprise Linux 6 through 10 and OpenShift Containe

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise Module for Basesystem 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected
SUSE Linux Enterprise Server 16.0 Not-Affected

Share

EUVD-2026-46046 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy