CVE-2026-64612

Libcupsfilters provides a library, which implements common functions used in cups-browsed daemon and printing filters, and additional files as banner templates and character sets. The filters are used in CUPS daemon and in printer applications.

Security Fix(es):

• libcupsfilters: cups-filters: libcupsfilters: CPU exhaustion via infinite loop in cfIEEE1284NormalizeMakeModel() (CVE-2026-64611)

• libcupsfilters: cups-filters: libcupsfilters: CUPS image filter process abort via malformed PNG (CVE-2026-64612)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The cups-filters package contains back ends, filters, and other software that was once part of the core Common UNIX Printing System (CUPS) distribution but is now maintained independently.

Security Fix(es):

• libcupsfilters: cups-filters: libcupsfilters: CUPS image filter process abort via malformed PNG (CVE-2026-64612)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The cups-filters package contains back ends, filters, and other software that was once part of the core Common UNIX Printing System (CUPS) distribution but is now maintained independently.

Security Fix(es):

• libcupsfilters: cups-filters: libcupsfilters: CUPS image filter process abort via malformed PNG (CVE-2026-64612)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

A flaw was found in libcupsfilters and cups-filters. The PNG image reading function creates a libpng reader without installing an error recovery handler, causing the CUPS image filter process to abort when processing a malformed PNG file. An unauthenticated attacker could exploit this by submitting a specially crafted PNG print job, leading to denial of service of the in-flight print job.

Libcupsfilters provides a library, which implements common functions used in cups-browsed daemon and printing filters, and additional files as banner templates and character sets. The filters are used in CUPS daemon and in printer applications.

Security Fix(es):

• libcupsfilters: cups-filters: libcupsfilters: CPU exhaustion via infinite loop in cfIEEE1284NormalizeMakeModel() (CVE-2026-64611)
• libcupsfilters: cups-filters: libcupsfilters: CUPS image filter process abort via malformed PNG (CVE-2026-64612)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The cups-filters package contains back ends, filters, and other software that was once part of the core Common UNIX Printing System (CUPS) distribution but is now maintained independently.

Security Fix(es):

• libcupsfilters: cups-filters: libcupsfilters: CUPS image filter process abort via malformed PNG (CVE-2026-64612)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The cups-filters package contains back ends, filters, and other software that was once part of the core Common UNIX Printing System (CUPS) distribution but is now maintained independently.

Security Fix(es):

• libcupsfilters: cups-filters: libcupsfilters: CUPS image filter process abort via malformed PNG (CVE-2026-64612)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

• CVE-2026-64612: image-png.c: handle libpng errors via longjmp()/setjmp() so a malformed PNG print job returns an error instead of aborting the CUPS image filter process.

• CVE-2026-64612: fix denial of service in PNG image filter by handling libpng errors via setjmp()/longjmp() instead of aborting

cpu exhaustion via infinite loop in cfieee1284normalizemakemodel(). (CVE-2026-64611) cups image filter process abort via malformed png. (CVE-2026-64612)

These are all security issues fixed in the cups-filters-1.28.17-9.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the libcupsfilters-2.1.1-2.1 package on the GA media of openSUSE Tumbleweed.

This update for libcupsfilters fixes the following issues:

• CVE-2026-64611: infinite-loop CPU-exhaustion DoS in cfIEEE1284NormalizeMakeModel on empty MDL field (bsc#1273145).
• CVE-2026-64612: malformed PNG aborts CUPS image filter process (bsc#1273146).

This update for cups-filters fixes the following issues:

Changes in cups-filters:

• CVE-2026-64611: Fixed Infinite-loop CPU-exhaustion DoS in cfIEEE1284NormalizeMakeModel on empty MDL field. A user who controls an IEEE-1284 device ID consumed by cfIEEE1284GetMakeModel can drive cfIEEE1284NormalizeMakeModel into an infinite loop. (bsc#1273145,GHSA-rcq7-rv5g-j3r4)

• CVE-2026-64612: Fixed Malformed PNG aborts CUPS image filter process (missing libpng setjmp recovery) A authenticated client that can submit an image print job can abort the CUPS filter process by supplying a malformed PNG. (bsc#1273146,GHSA-7mxj-cfq5-84ch)

• Provide cups-browsed as separated cups-filters-cups-browsed sub-package so users can uninstall this sub-package to completely avoid the generic security risk of cups-browsed. cups-browsed auto-creates local print queues for printers which are announced via DNS-SD. It is a generic security risk when a service (cups-browsed.service) accepts any (possibly malicious) incoming information from any host in the local network (i.e. any DNS-SD announcements) and from that information it auto-creates print queue configurations for CUPS (where its server program cupsd runs as root). For more information see the openSUSE support database article https://en.opensuse.org/SDB:CUPS_and_SANE_Firewall_settings

• Fixed a regression "Error about PPD file during 'driverless' printer setup" (boo#1256868) and "ppd pull out from [driverless] printer feature broken" (bsc#1256977)

• unbreak qpdf [bsc#1253678]

• CVE-2024-47176: Fixed cups-browsed binds to UDP INADDR_ANY:631 (bsc#1230939) and to avoid CVE-2024-47850 "cups-browsed can be abused to initiate remote DDoS against third-party targets" (bsc#1231294) by removing legacy CUPS Browsing support in cups-browsed (introduced 2012) which is no longer needed nowadays. CUPS browsing was removed from CUPS since version 1.6. Legacy CUPS Browsing is a generic security risk, see the section "Automated print queue setup via cups-browsed" in https://en.opensuse.org/SDB:CUPS_and_SANE_Firewall_settings

• CVE-2024-47076: Fixed lack of input sanitization in cfGetPrinterAttributes5 (bsc#1230937)

• CVE-2024-47175: Fixed lack of input sanitization in _ppdCreateFromIPP() (bsc#1230932)

• In general regarding CUPS and cups-browsed security issues see https://en.opensuse.org/SDB:CUPS_and_SANE_Firewall_settings

This update for libcupsfilters fixes the following issues:

• CVE-2026-64611: infinite-loop CPU-exhaustion DoS in cfIEEE1284NormalizeMakeModel on empty MDL field (bsc#1273145).
• CVE-2026-64612: malformed PNG aborts CUPS image filter process (bsc#1273146).

This update for libcupsfilters fixes the following issues:

• CVE-2026-64611: infinite-loop CPU-exhaustion DoS in cfIEEE1284NormalizeMakeModel on empty MDL field (bsc#1273145).
• CVE-2026-64612: malformed PNG aborts CUPS image filter process (bsc#1273146).

This update for cups-filters fixes the following issues:

• CVE-2026-64611: user who controls an IEEE-1284 device ID consumed by cfIEEE1284GetMakeModel can drive cfIEEE1284NormalizeMakeModel into an infinite loop (bsc#1273145).
• CVE-2026-64612: authenticated client that can submit an image print job can abort the CUPS filter process by supplying a malformed PNG (bsc#1273146).

This update for cups-filters fixes the following issues:

• CVE-2026-64611: user who controls an IEEE-1284 device ID consumed by cfIEEE1284GetMakeModel can drive cfIEEE1284NormalizeMakeModel into an infinite loop (bsc#1273145).
• CVE-2026-64612: authenticated client that can submit an image print job can abort the CUPS filter process by supplying a malformed PNG (bsc#1273146).