Log in Start free

Vulnerability · Published Nov 12, 2025 · Assigned by GitHub_M

CVE-2025-57812[BIGSLEEP-434612419] CUPS-Filters has heap-buffer-overflow write in `cfImageLut()`

Low 3.7

In plain English

A low-severity out-of-bounds read in libcupsfilters from OpenPrinting. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)3.7Low
Exploit odds (30 days)0.5%top 58.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

CUPS is a standards-based, open-source printing system, and `libcupsfilters` contains the code of the filters of the former `cups-filters` package as library functions to be used for the data format conversion tasks needed in Printer Applications. In CUPS-Filters versions up to and including 1.28.17 and libscupsfilters versions 2.0.0 through 2.1.1, CUPS-Filters's `imagetoraster` filter has an out of bounds read/write vulnerability in the processing of TIFF image files. While the pixel buffer is allocated with the number of pixels times a pre-calculated bytes-per-pixel value, the function which processes these pixels is called with a size of the number of pixels times 3. When suitable inputs are passed, the bytes-per-pixel value can be set to 1 and bytes outside of the buffer bounds get processed. In order to trigger the bug, an attacker must issue a print job with a crafted TIFF file, and pass appropriate print job options to control the bytes-per-pixel value of the output format. They must choose a printer configuration under which the `imagetoraster` filter or its C-function equivalent `cfFilterImageToRaster()` gets invoked. The vulnerability exists in both CUPS-Filters 1.x and the successor library libcupsfilters (CUPS-Filters 2.x). In CUPS-Filters 2.x, the vulnerable function is `_cfImageReadTIFF() in libcupsfilters`. When this function is invoked as part of `cfFilterImageToRaster()`, the caller passes a look-up-table during whose processing the out of bounds memory access happens. In CUPS-Filters 1.x, the equivalent functions are all found in the cups-filters repository, which is not split into subprojects yet, and the vulnerable code is in `_cupsImageReadTIFF()`, which is called through `cupsImageOpen()` from the `imagetoraster` tool. A patch is available in commit b69dfacec7f176281782e2f7ac44f04bf9633cfa.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12cups-filters1.28.17-3+deb12u2DEBIAN-CVE-2025-57812
Debian:13cups-filters1.28.17-6+deb13u1DEBIAN-CVE-2025-57812
Debian:14cups-filters1.28.17-7DEBIAN-CVE-2025-57812
Debian:13libcupsfilters2.0.0-3+deb13u1DEBIAN-CVE-2025-57812
Debian:14libcupsfilters2.1.1-2DEBIAN-CVE-2025-57812
Ubuntu:22.04:LTScups-filters1.28.15-0ubuntu1.5USN-7878-1
Ubuntu:22.04:LTScups-filters1.28.15-0ubuntu1.5UBUNTU-CVE-2025-57812
Ubuntu:24.04:LTScups-filters2.0.0-0ubuntu4.1USN-7878-1
Ubuntu:25.10cups-filters2.0.1-0ubuntu3.25.10.1USN-7878-1
Ubuntu:24.04:LTSlibcupsfilters2.0.0-0ubuntu7.2USN-7877-1
Ubuntu:24.04:LTSlibcupsfilters2.0.0-0ubuntu7.2UBUNTU-CVE-2025-57812
Ubuntu:25.10libcupsfilters2.1.1-0ubuntu3.1UBUNTU-CVE-2025-57812
Ubuntu:25.10libcupsfilters2.1.1-0ubuntu3.1USN-7877-1

Affected products (as reported)

VendorProductVersions
OpenPrinting libcupsfilters cups-filters <= 1.28.17libcupsfilters >= 2.0.0, < 2.1.1

Weakness: CWE-125, CWE-787 · Vector: CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

References