Vulnerability · Published Jul 20, 2026 · Assigned by redhat
CVE-2026-64612Libcupsfilters: cups-filters: libcupsfilters: cups image filter process abort via malformed png
High 7.5
In plain English
A high-severity security flaw in Red Hat Enterprise Linux 10 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 53% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
A flaw was found in libcupsfilters and cups-filters. The PNG image reading function creates a libpng reader without installing an error recovery handler, causing the CUPS image filter process to abort when processing a malformed PNG file. An unauthenticated attacker could exploit this by submitting a specially crafted PNG print job, leading to denial of service of the in-flight print job.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | cups-filters | 1.20.0-36.el8_10.1 | ALSA-2026:57451 |
| AlmaLinux:9 | cups-filters | 1.28.7-27.el9_8 | ALSA-2026:58560 |
| AlmaLinux:8 | cups-filters-devel | 1.20.0-36.el8_10.1 | ALSA-2026:57451 |
| AlmaLinux:9 | cups-filters-devel | 1.28.7-27.el9_8 | ALSA-2026:58560 |
| AlmaLinux:8 | cups-filters-libs | 1.20.0-36.el8_10.1 | ALSA-2026:57451 |
| AlmaLinux:9 | cups-filters-libs | 1.28.7-27.el9_8 | ALSA-2026:58560 |
| AlmaLinux:10 | libcupsfilters | 1:2.0.0-13.el10_2 | ALSA-2026:56965 |
| Debian:12 | cups-filters | no fix listed | DEBIAN-CVE-2026-64612 |
| Debian:13 | cups-filters | no fix listed | DEBIAN-CVE-2026-64612 |
| Debian:14 | cups-filters | no fix listed | DEBIAN-CVE-2026-64612 |
| Debian:13 | libcupsfilters | no fix listed | DEBIAN-CVE-2026-64612 |
| Debian:14 | libcupsfilters | no fix listed | DEBIAN-CVE-2026-64612 |
| Rocky Linux:8 | cups-filters | 0:1.20.0-36.el8_10.1 | RLSA-2026:57451 |
| Rocky Linux:9 | cups-filters | 0:1.28.7-27.el9_8 | RLSA-2026:58560 |
| Rocky Linux:10 | libcupsfilters | 1:2.0.0-13.el10_2 | RLSA-2026:56965 |
| Ubuntu:22.04:LTS | cups-filters | no fix listed | UBUNTU-CVE-2026-64612 |
| Ubuntu:24.04:LTS | cups-filters | no fix listed | UBUNTU-CVE-2026-64612 |
| Ubuntu:26.04:LTS | cups-filters | no fix listed | UBUNTU-CVE-2026-64612 |
| Ubuntu:26.10 | cups-filters | no fix listed | UBUNTU-CVE-2026-64612 |
| Ubuntu:24.04:LTS | libcupsfilters | no fix listed | UBUNTU-CVE-2026-64612 |
| Ubuntu:26.04:LTS | libcupsfilters | no fix listed | UBUNTU-CVE-2026-64612 |
| Ubuntu:26.10 | libcupsfilters | no fix listed | UBUNTU-CVE-2026-64612 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | see references |
| Red Hat | Red Hat Enterprise Linux 8 | see references |
| Red Hat | Red Hat Enterprise Linux 9 | see references |
| Red Hat | Red Hat Enterprise Linux 10 | see references |
| Red Hat | Red Hat Enterprise Linux 7 | see references |
Weakness: CWE-248 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
- RHSA-2026:56965 vendor-advisory, x_refsource_REDHAT
- RHSA-2026:57451 vendor-advisory, x_refsource_REDHAT
- RHSA-2026:58560 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/security/cve/CVE-2026-64612 vdb-entry, x_refsource_REDHAT
- RHBZ#2502801 issue-tracking, x_refsource_REDHAT
- https://github.com/OpenPrinting/libcupsfilters/security/advisories/GHSA-7mxj-cfq5-84ch