{"id":"CVE-2025-64503","aliases":["CLSA-2026-1773308416","DEBIAN-CVE-2025-64503","DLA-4380-1","EUVD-2025-150365","GHSA-893j-2wr2-wrh9","MGASA-2025-0304","OESA-2025-2719","RHSA-2026:8814","SUSE-SU-2025:4158-1","SUSE-SU-2025:4198-1","UBUNTU-CVE-2025-64503","USN-7877-1","USN-7878-1"],"status":"published","title":"[BIGSLEEP-434615384] cups-filters 1.x: out of bounds write in pdftoraster","description":"cups-filters contains backends, filters, and other software required to get the cups printing service working on operating systems other than macos. In cups-filters prior to 1.28.18, by crafting a PDF file with a large `MediaBox` value, an attacker can cause CUPS-Filter 1.x’s `pdftoraster` tool to write beyond the bounds of an array. First, a PDF with a large `MediaBox` width value causes `header.cupsWidth` to become large.  Next, the calculation of `bytesPerLine = (header.cupsBitsPerPixel * header.cupsWidth + 7) / 8` overflows, resulting in a small value. Then, `lineBuf` is allocated with the small `bytesPerLine` size. Finally, `convertLineChunked` calls `writePixel8`, which attempts to write to `lineBuf` outside of its buffer size (out of bounds write). In libcupsfilters, the maintainers found the same `bytesPerLine` multiplication without overflow check, but the provided test case does not cause an overflow there, because the values are different. Commit 50d94ca0f2fa6177613c97c59791bde568631865 contains a patch, which is incorporated into cups-filters version 1.28.18.","severity":{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00228,"percentile":0.13676,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-787"],"published":"2025-11-12T00:00:00Z","modified":"2026-10-28T11:00:32Z","fixes":[{"ecosystem":"Debian:12","package":"cups-filters","fixed_in":["1.28.17-3+deb12u2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"cups-filters","fixed_in":["1.28.17-6+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"cups-filters","fixed_in":["1.28.17-7"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libcupsfilters","fixed_in":["2.0.0-3+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libcupsfilters","fixed_in":["2.1.1-2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"cups-filters","fixed_in":["1.8.3-2ubuntu3.5+esm3"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"cups-filters","fixed_in":["1.20.2-0ubuntu3.3+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"cups-filters","fixed_in":["1.27.4-1ubuntu0.4+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"cups-filters","fixed_in":["1.28.15-0ubuntu1.5"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"libcupsfilters","fixed_in":["2.0.0-0ubuntu7.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"libcupsfilters","fixed_in":["2.1.1-0ubuntu3.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"cups-filters","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.28.7-11.el9_2.1.tuxcare.els5"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"cups-filters-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.28.7-11.el9_2.1.tuxcare.els5"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"cups-filters-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.28.7-11.el9_2.1.tuxcare.els5"}]}],"bundled":2},{"source":"osv","ecosystem":"Debian:12","package":"cups-filters","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.28.17-3+deb12u2"}]}],"versions":["1.28.17-3","1.28.17-3+deb12u1"]},{"source":"osv","ecosystem":"Debian:13","package":"cups-filters","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.28.17-6+deb13u1"}]}],"versions":["1.28.17-6"]},{"source":"osv","ecosystem":"Debian:14","package":"cups-filters","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.28.17-7"}]}],"versions":["1.28.17-6"]},{"source":"osv","ecosystem":"Debian:13","package":"libcupsfilters","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0-3+deb13u1"}]}],"versions":["2.0.0-3"]},{"source":"osv","ecosystem":"Debian:14","package":"libcupsfilters","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.1-2"}]}],"versions":["2.0.0-3","2.1.1-1"]},{"source":"osv","ecosystem":"Debian:11","package":"cups-filters","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.28.7-1+deb11u4"}]}],"versions":["1.28.7-1","1.28.7-1+deb11u1","1.28.7-1+deb11u2","1.28.7-1+deb11u3"],"bundled":3},{"source":"osv","ecosystem":"Mageia:9","package":"cups-filters","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.28.16-6.2.mga9"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"cups-filters","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.28.9-6.oe2203sp4"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"cups-filters","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.28.15-5.oe2403sp2"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"cups-filters","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.28.15-5.oe2403sp1"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP2","package":"cups-filters","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.28.15-5.oe2403sp2"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"cups-filters","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.1-7.oe2003sp4"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"cups-filters","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.28.9-6.oe2203sp3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.17-1.hum1"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"cups-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.17-1.hum1"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"cups-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.17-1.hum1"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"cups-filesystem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.17-1.hum1"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"cups-ipptool","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.17-1.hum1"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"cups-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.17-1.hum1"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"cups-lpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.17-1.hum1"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"cups-printerapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.17-1.hum1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"cups-filters","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.0-150200.3.25.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"cups-filters","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.0-150200.3.25.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"cups-filters","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.0-150200.3.25.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"cups-filters","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.58-19.35.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"cups-filters","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.3-2ubuntu3.5+esm3"}]}],"versions":["1.0.76-1","1.1.0-1","1.1.0-1build1","1.3.0-1","1.4.0-1","1.5.0-1","1.6.0-1","1.7.0-1","1.8.1-1","1.8.2-1","1.8.2-2","1.8.2-2ubuntu2","1.8.2-2ubuntu3","1.8.3-2ubuntu1","1.8.3-2ubuntu2","1.8.3-2ubuntu3","1.8.3-2ubuntu3.1","1.8.3-2ubuntu3.4","1.8.3-2ubuntu3.5","1.8.3-2ubuntu3.5+esm1","1.8.3-2ubuntu3.5+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"cups-filters","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.2-0ubuntu3.3+esm2"}]}],"versions":["1.17.9-0ubuntu1","1.17.9-1","1.20.0-2","1.20.1-1","1.20.1-1build1","1.20.2-0ubuntu1","1.20.2-0ubuntu2","1.20.2-0ubuntu3","1.20.2-0ubuntu3.1","1.20.2-0ubuntu3.3","1.20.2-0ubuntu3.3+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"cups-filters","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27.4-1ubuntu0.4+esm1"}]}],"versions":["1.25.11-0ubuntu1","1.25.11-1","1.25.12-1","1.25.13-1","1.26.0-1","1.26.1-1","1.26.2-1","1.27.0-1","1.27.0-2","1.27.1-1","1.27.1-2","1.27.1-3","1.27.2-1","1.27.3-1","1.27.4-1","1.27.4-1ubuntu0.2","1.27.4-1ubuntu0.3","1.27.4-1ubuntu0.4"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"cups-filters","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.28.15-0ubuntu1.5"}]}],"versions":["1.28.10-2","1.28.11-1","1.28.11-2","1.28.12-1","1.28.13-0ubuntu1","1.28.14-1","1.28.15-0ubuntu1","1.28.15-0ubuntu1.2","1.28.15-0ubuntu1.3","1.28.15-0ubuntu1.4"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libcupsfilters","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0-0ubuntu7.2"}]}],"versions":["2.0.0-0ubuntu1","2.0.0-0ubuntu6","2.0.0-0ubuntu7","2.0.0-0ubuntu7.1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"libcupsfilters","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.1-0ubuntu3.1"}]}],"versions":["2.1.1-0ubuntu2","2.1.1-0ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libcupsfilters","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0-0ubuntu7.2"}]}],"versions":["2.0.0-0ubuntu1","2.0.0-0ubuntu6","2.0.0-0ubuntu7","2.0.0-0ubuntu7.1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"libcupsfilters","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.1-0ubuntu3.1"}]}],"versions":["2.1.1-0ubuntu2","2.1.1-0ubuntu3"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"cups-filters","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.3-2ubuntu3.5+esm3"}]}],"versions":["1.0.76-1","1.1.0-1","1.1.0-1build1","1.3.0-1","1.4.0-1","1.5.0-1","1.6.0-1","1.7.0-1","1.8.1-1","1.8.2-1","1.8.2-2","1.8.2-2ubuntu2","1.8.2-2ubuntu3","1.8.3-2ubuntu1","1.8.3-2ubuntu2","1.8.3-2ubuntu3","1.8.3-2ubuntu3.1","1.8.3-2ubuntu3.4","1.8.3-2ubuntu3.5","1.8.3-2ubuntu3.5+esm1","1.8.3-2ubuntu3.5+esm2"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"cups-filters","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.2-0ubuntu3.3+esm2"}]}],"versions":["1.17.9-0ubuntu1","1.17.9-1","1.20.0-2","1.20.1-1","1.20.1-1build1","1.20.2-0ubuntu1","1.20.2-0ubuntu2","1.20.2-0ubuntu3","1.20.2-0ubuntu3.1","1.20.2-0ubuntu3.3","1.20.2-0ubuntu3.3+esm1"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"cups-filters","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27.4-1ubuntu0.4+esm1"}]}],"versions":["1.25.11-0ubuntu1","1.25.11-1","1.25.12-1","1.25.13-1","1.26.0-1","1.26.1-1","1.26.2-1","1.27.0-1","1.27.0-2","1.27.1-1","1.27.1-2","1.27.1-3","1.27.2-1","1.27.3-1","1.27.4-1","1.27.4-1ubuntu0.2","1.27.4-1ubuntu0.3","1.27.4-1ubuntu0.4"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"cups-filters","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.28.15-0ubuntu1.5"}]}],"versions":["1.28.10-2","1.28.11-1","1.28.11-2","1.28.12-1","1.28.13-0ubuntu1","1.28.14-1","1.28.15-0ubuntu1","1.28.15-0ubuntu1.2","1.28.15-0ubuntu1.3","1.28.15-0ubuntu1.4"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"cups-filters","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0-0ubuntu4.1"}]}],"versions":["2.0.0-0ubuntu1","2.0.0-0ubuntu3","2.0.0-0ubuntu4"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"cups-filters","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.1-0ubuntu3.25.10.1"}]}],"versions":["2.0.1-0ubuntu3"],"bundled":3}],"products":[{"vendor":"openprinting","product":"cups-filters"},{"vendor":"openprinting","product":"libcupsfilters"}],"references":[{"url":"https://github.com/OpenPrinting/cups-filters/security/advisories/GHSA-893j-2wr2-wrh9","tags":["x_refsource_CONFIRM","Exploit","Vendor Advisory","advisory","article","report"]},{"url":"https://github.com/OpenPrinting/cups-filters/commit/50d94ca0f2fa6177613c97c59791bde568631865","tags":["x_refsource_MISC","Patch","fix","article"]},{"url":"https://github.com/OpenPrinting/cups-filters/blob/aea8d0db017e495b0204433ebdb0e86b4871094c/filter/pdftoraster.cxx#L1620","tags":["x_refsource_MISC","Product","web","article"]},{"url":"https://github.com/OpenPrinting/cups-filters/blob/aea8d0db017e495b0204433ebdb0e86b4871094c/filter/pdftoraster.cxx#L1880","tags":["x_refsource_MISC","Product","web","article"]},{"url":"https://github.com/OpenPrinting/libcupsfilters/blob/1dd86d835b27ed149b66aee1a4853d1db8a1f44c/cupsfilters/pdftoraster.cxx#L1790","tags":["x_refsource_MISC","Product","web","article"]},{"url":"http://www.openwall.com/lists/oss-security/2025/11/12/2","tags":["Mailing List","Third Party Advisory","web","article"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1773308416.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/64xxx/CVE-2025-64503.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-64503","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-64503","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2025-0304.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=34746","tags":["report"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2719","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-57812","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:8814","tags":["advisory"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-58364","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-58060","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-64503","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-58436","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-57812","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-39316","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-39314","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-34990","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-34980","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-34979","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-34978","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-27447","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_8814.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2414632","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-57812","tags":["advisory"]},{"url":"https://github.com/OpenPrinting/cups-filters/blob/3c58463e341b12c9d30d7d3807d2bac1bc595a78/cupsfilters/image-tiff.c#L34","tags":["article"]},{"url":"https://github.com/OpenPrinting/cups-filters/blob/3c58463e341b12c9d30d7d3807d2bac1bc595a78/filter/imagetoraster.c#L613","tags":["article"]},{"url":"https://github.com/OpenPrinting/libcupsfilters/blob/33421982e10f6a14bc0bab03b80c9cf4660e8d7d/cupsfilters/image-tiff.c#L32","tags":["article"]},{"url":"https://github.com/OpenPrinting/libcupsfilters/commit/b69dfacec7f176281782e2f7ac44f04bf9633cfa","tags":["article"]},{"url":"https://github.com/OpenPrinting/libcupsfilters/security/advisories/GHSA-jpxg-qc2c-hgv4","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2392595","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-58060","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-58060","tags":["advisory"]},{"url":"https://github.com/OpenPrinting/cups/security/advisories/GHSA-4c68-qgrh-rmmq","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2393078","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-58364","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-58364","tags":["advisory"]},{"url":"https://github.com/OpenPrinting/cups/security/advisories/GHSA-7qx3-r744-6qv4","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2416040","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-58436","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-58436","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2414705","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-64503","tags":["advisory","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2454949","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-27447","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-27447","tags":["advisory"]},{"url":"https://github.com/OpenPrinting/cups/commit/88516bf6d9e34cef7a64a704b856b837f70cd220","tags":["article"]},{"url":"https://github.com/OpenPrinting/cups/security/advisories/GHSA-v987-m8hp-phj9","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2454957","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-34978","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34978","tags":["advisory"]},{"url":"https://github.com/OpenPrinting/cups/security/advisories/GHSA-f53q-7mxp-9gcr","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2454946","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-34979","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34979","tags":["advisory"]},{"url":"https://github.com/OpenPrinting/cups/security/advisories/GHSA-6qxf-7jx6-86fh","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2454954","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-34980","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34980","tags":["advisory"]},{"url":"https://github.com/OpenPrinting/cups/security/advisories/GHSA-4852-v58g-6cwf","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2454947","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-34990","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34990","tags":["advisory"]},{"url":"https://github.com/OpenPrinting/cups/security/advisories/GHSA-c54j-2vqw-wpwp","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2456107","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-39314","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-39314","tags":["advisory"]},{"url":"https://github.com/OpenPrinting/cups/security/advisories/GHSA-pp8w-2g52-7vj7","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2456120","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-39316","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-39316","tags":["advisory"]},{"url":"https://github.com/OpenPrinting/cups/security/advisories/GHSA-pjv5-prqp-46rg","tags":["article"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20254158-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1253364","tags":["report"]},{"url":"https://bugzilla.suse.com/1253373","tags":["report"]},{"url":"https://bugzilla.suse.com/1253374","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-57812","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-64503","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-64524","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20254198-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-64503","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2025/11/12/2","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7877-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-7878-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-57812","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-64524","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2025-64503","title":"[BIGSLEEP-434615384] cups-filters 1.x: out of bounds write in pdftoraster","description":"cups-filters contains backends, filters, and other software required to get the cups printing service working on operating systems other than macos. In cups-filters prior to 1.28.18, by crafting a PDF file with a large `MediaBox` value, an attacker can cause CUPS-Filter 1.x’s `pdftoraster` tool to write beyond the bounds of an array. First, a PDF with a large `MediaBox` width value causes `header.cupsWidth` to become large.  Next, the calculation of `bytesPerLine = (header.cupsBitsPerPixel * header.cupsWidth + 7) / 8` overflows, resulting in a small value. Then, `lineBuf` is allocated with the small `bytesPerLine` size. Finally, `convertLineChunked` calls `writePixel8`, which attempts to write to `lineBuf` outside of its buffer size (out of bounds write). In libcupsfilters, the maintainers found the same `bytesPerLine` multiplication without overflow check, but the provided test case does not cause an overflow there, because the values are different. Commit 50d94ca0f2fa6177613c97c59791bde568631865 contains a patch, which is incorporated into cups-filters version 1.28.18.","status":"published","published":"2025-11-12T22:04:03.75Z","modified":"2025-11-13T16:56:18.053Z","cvss":[{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:32:46.750177Z"}],"euvd":[{"id":"EUVD-2025-150365","description":"cups-filters contains backends, filters, and other software required to get the cups printing service working on operating systems other than macos. In cups-filters prior to 1.28.18, by crafting a PDF file with a large `MediaBox` value, an attacker can cause CUPS-Filter 1.x’s `pdftoraster` tool to write beyond the bounds of an array. First, a PDF with a large `MediaBox` width value causes `header.cupsWidth` to become large.  Next, the calculation of `bytesPerLine = (header.cupsBitsPerPixel * header.cupsWidth + 7) / 8` overflows, resulting in a small value. Then, `lineBuf` is allocated with the small `bytesPerLine` size. Finally, `convertLineChunked` calls `writePixel8`, which attempts to write to `lineBuf` outside of its buffer size (out of bounds write). In libcupsfilters, the maintainers found the same `bytesPerLine` multiplication without overflow check, but the provided test case does not cause an overflow there, because the values are different. Commit 50d94ca0f2fa6177613c97c59791bde568631865 contains a patch, which is incorporated into cups-filters version 1.28.18.","status":"published","published":"2025-11-12T22:04:03Z","modified":"2025-11-13T16:56:18Z","cvss":[{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T19:49:17.986196Z"}],"nvd":[{"id":"CVE-2025-64503","description":"cups-filters contains backends, filters, and other software required to get the cups printing service working on operating systems other than macos. In cups-filters prior to 1.28.18, by crafting a PDF file with a large `MediaBox` value, an attacker can cause CUPS-Filter 1.x’s `pdftoraster` tool to write beyond the bounds of an array. First, a PDF with a large `MediaBox` width value causes `header.cupsWidth` to become large.  Next, the calculation of `bytesPerLine = (header.cupsBitsPerPixel * header.cupsWidth + 7) / 8` overflows, resulting in a small value. Then, `lineBuf` is allocated with the small `bytesPerLine` size. Finally, `convertLineChunked` calls `writePixel8`, which attempts to write to `lineBuf` outside of its buffer size (out of bounds write). In libcupsfilters, the maintainers found the same `bytesPerLine` multiplication without overflow check, but the provided test case does not cause an overflow there, because the values are different. Commit 50d94ca0f2fa6177613c97c59791bde568631865 contains a patch, which is incorporated into cups-filters version 1.28.18.","status":"published","published":"2025-11-12T22:15:50.293Z","modified":"2026-10-18T20:10:00.11Z","cvss":[{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"secondary"},{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","level":"low","assessor":"primary"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:11:43.650381Z"}],"osv":[{"id":"CVE-2025-64503","title":"[BIGSLEEP-434615384] cups-filters 1.x: out of bounds write in pdftoraster","description":"cups-filters contains backends, filters, and other software required to get the cups printing service working on operating systems other than macos. In cups-filters prior to 1.28.18, by crafting a PDF file with a large `MediaBox` value, an attacker can cause CUPS-Filter 1.x’s `pdftoraster` tool to write beyond the bounds of an array. First, a PDF with a large `MediaBox` width value causes `header.cupsWidth` to become large.  Next, the calculation of `bytesPerLine = (header.cupsBitsPerPixel * header.cupsWidth + 7) / 8` overflows, resulting in a small value. Then, `lineBuf` is allocated with the small `bytesPerLine` size. Finally, `convertLineChunked` calls `writePixel8`, which attempts to write to `lineBuf` outside of its buffer size (out of bounds write). In libcupsfilters, the maintainers found the same `bytesPerLine` multiplication without overflow check, but the provided test case does not cause an overflow there, because the values are different. Commit 50d94ca0f2fa6177613c97c59791bde568631865 contains a patch, which is incorporated into cups-filters version 1.28.18.","status":"published","published":"2025-11-12T22:04:03.75Z","modified":"2026-10-28T11:00:32.733435428Z","cvss":[{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T15:44:51.851511Z"},{"id":"DEBIAN-CVE-2025-64503","description":"cups-filters contains backends, filters, and other software required to get the cups printing service working on operating systems other than macos. In cups-filters prior to 1.28.18, by crafting a PDF file with a large `MediaBox` value, an attacker can cause CUPS-Filter 1.x’s `pdftoraster` tool to write beyond the bounds of an array. First, a PDF with a large `MediaBox` width value causes `header.cupsWidth` to become large.  Next, the calculation of `bytesPerLine = (header.cupsBitsPerPixel * header.cupsWidth + 7) / 8` overflows, resulting in a small value. Then, `lineBuf` is allocated with the small `bytesPerLine` size. Finally, `convertLineChunked` calls `writePixel8`, which attempts to write to `lineBuf` outside of its buffer size (out of bounds write). In libcupsfilters, the maintainers found the same `bytesPerLine` multiplication without overflow check, but the provided test case does not cause an overflow there, because the values are different. Commit 50d94ca0f2fa6177613c97c59791bde568631865 contains a patch, which is incorporated into cups-filters version 1.28.18.","status":"published","published":"2025-11-12T22:15:50.293Z","modified":"2026-10-23T17:47:48.017385368Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","level":"low"}],"updated_at":"2026-11-02T15:45:47.697959Z"},{"id":"OESA-2025-2719","title":"cups-filters security update","description":"This project provides backends, filters, and other software that was once part of the core CUPS distribution but is no longer maintained by Apple Inc. In addition it contains additional filters and software developed independently of Apple, especially filters for the PDF-centric printing workflow introduced by OpenPrinting and a daemon to browse Bonjour broadcasts of remote CUPS printers to make these printers available locally and to provide backward compatibility to the old CUPS broadcasting and browsing of CUPS 1.5.x and older.\r\n\r\nSecurity Fix(es):\n\nCUPS is a standards-based, open-source printing system, and libcupsfilters contains the code of the filters of the former cups-filters package. In CUPS-Filters versions up to and including 1.28.17 and libcupsfilters versions 2.0.0 through 2.1.1, the imagetoraster filter has an out of bounds read/write vulnerability in the processing of TIFF image files. While the pixel buffer is allocated with the number of pixels times a pre-calculated bytes-per-pixel value, the function which processes these pixels is called with a size of the number of pixels times 3. When suitable inputs are passed, the bytes-per-pixel value can be set to 1 and bytes outside of the buffer bounds get processed. An attacker must issue a print job with a crafted TIFF file and control the bytes-per-pixel value of the output format. The vulnerability exists in both CUPS-Filters 1.x and libcupsfilters 2.x. A patch is available in commit b69dfacec7f176281782e2f7ac44f04bf9633cfa.(CVE-2025-57812)\n\ncups-filters contains backends, filters, and other software required to get the cups printing service working on operating systems other than macos. In cups-filters prior to 1.28.18, by crafting a PDF file with a large `MediaBox` value, an attacker can cause CUPS-Filter 1.x’s `pdftoraster` tool to write beyond the bounds of an array. First, a PDF with a large `MediaBox` width value causes `header.cupsWidth` to become large.  Next, the calculation of `bytesPerLine = (header.cupsBitsPerPixel * header.cupsWidth + 7) / 8` overflows, resulting in a small value. Then, `lineBuf` is allocated with the small `bytesPerLine` size. Finally, `convertLineChunked` calls `writePixel8`, which attempts to write to `lineBuf` outside of its buffer size (out of bounds write). In libcupsfilters, the maintainers found the same `bytesPerLine` multiplication without overflow check, but the provided test case does not cause an overflow there, because the values are different. Commit 50d94ca0f2fa6177613c97c59791bde568631865 contains a patch, which is incorporated into cups-filters version 1.28.18.(CVE-2025-64503)","status":"published","published":"2025-11-22T11:09:50Z","modified":"2026-08-18T01:19:20.96755191Z","cvss":[{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:44.957082Z"},{"id":"RHSA-2026:8814","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-04-20T10:12:14Z","modified":"2026-10-14T10:33:09Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.547034Z"},{"id":"UBUNTU-CVE-2025-64503","description":"cups-filters contains backends, filters, and other software required to get the cups printing service working on operating systems other than macos. In cups-filters prior to 1.28.18, by crafting a PDF file with a large `MediaBox` value, an attacker can cause CUPS-Filter 1.x’s `pdftoraster` tool to write beyond the bounds of an array. First, a PDF with a large `MediaBox` width value causes `header.cupsWidth` to become large.  Next, the calculation of `bytesPerLine = (header.cupsBitsPerPixel * header.cupsWidth + 7) / 8` overflows, resulting in a small value. Then, `lineBuf` is allocated with the small `bytesPerLine` size. Finally, `convertLineChunked` calls `writePixel8`, which attempts to write to `lineBuf` outside of its buffer size (out of bounds write). In libcupsfilters, the maintainers found the same `bytesPerLine` multiplication without overflow check, but the provided test case does not cause an overflow there, because the values are different. Commit 50d94ca0f2fa6177613c97c59791bde568631865 contains a patch, which is incorporated into cups-filters version 1.28.18.","status":"published","published":"2025-11-12T00:00:00Z","modified":"2026-04-22T16:08:49.150013Z","cvss":[{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"},{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","level":"low"}],"updated_at":"2026-11-02T16:55:52.345622Z"},{"id":"CLSA-2026-1773308416","title":"cups-filters: Fix of 2 CVEs","description":"- CVE-2025-64503: fix out-of-bounds write in pdftoraster filter caused by\n  integer overflow when processing PDFs with large MediaBox values\n- CVE-2025-57812: fix out-of-bounds read/write in imagetoraster TIFF processing\n  caused by incorrect buffer size calculation in cupsImageLut","status":"published","published":"2026-03-12T09:40:21Z","modified":"2026-10-21T10:47:21.845054322Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"DLA-4380-1","title":"cups-filters - security update","status":"published","published":"2025-11-25T00:00:00Z","modified":"2025-11-25T19:33:46.75956Z","updated_at":"2026-11-02T15:46:12.7027Z"},{"id":"MGASA-2025-0304","title":"Updated cups-filters packages fix security vulnerabilities","description":"CUPS-Filters has heap-buffer-overflow write in `cfImageLut()`.\n(CVE-2025-57812)\ncups-filters 1.x: out of bounds write in pdftoraster. (CVE-2025-64503)\n","status":"published","published":"2025-11-19T02:16:19Z","modified":"2026-04-16T04:43:34.318412533Z","updated_at":"2026-11-02T15:49:43.178336Z"},{"id":"SUSE-SU-2025:4158-1","title":"Security update for cups-filters","description":"This update for cups-filters fixes the following issues:\n\n- CVE-2025-64503: Fixed out-of-bounds write in pdftoraster tool (bsc#1253374)\n- CVE-2025-57812: Fixed multiple TIFF-related issues in libcupsfilters (bsc#1253373)\n- CVE-2025-64524: Fixed out-of-bounds write de to use of unvalidated length parameter in the rastertopclx filter (bsc#1253364)\n","status":"published","published":"2025-11-21T14:30:38Z","modified":"2026-02-04T02:18:04.349086Z","updated_at":"2026-11-02T15:54:00.344164Z"},{"id":"SUSE-SU-2025:4198-1","title":"Security update for cups-filters","description":"This update for cups-filters fixes the following issues:\n\n- CVE-2025-64503: Fixed out-of-bounds write in pdftoraster tool (bsc#1253374)\n- CVE-2025-57812: Fixed multiple TIFF-related issues in libcupsfilters (bsc#1253373)\n- CVE-2025-64524: Fixed out-of-bounds write de to use of unvalidated length parameter in the rastertopclx filter (bsc#1253364)\n","status":"published","published":"2025-11-24T11:59:54Z","modified":"2026-03-23T04:51:39.317502Z","updated_at":"2026-11-02T15:54:00.344164Z"},{"id":"USN-7877-1","title":"libcupsfilters vulnerabilities","description":"It was discovered that libcupsfilters incorrectly handled certain malformed\nTIFF image files. A remote attacker could use this issue to cause\nlibcupsfilters to crash, resulting in a denial of service, or possibly\nexecute arbitrary code. (CVE-2025-57812)\n\nIt was discovered that libcupsfilters incorrectly handled certain malformed\nPDF document files. A remote attacker could use this issue to cause\nlibcupsfilters to crash, resulting in a denial of service, or possibly\nexecute arbitrary code. (CVE-2025-64503)","status":"published","published":"2025-11-20T15:50:38Z","modified":"2026-04-22T11:03:01.307541Z","updated_at":"2026-11-02T16:58:21.91885Z"},{"id":"USN-7878-1","title":"cups-filters vulnerabilities","description":"It was discovered that cups-filters incorrectly handled certain malformed\nTIFF image files. A remote attacker could use this issue to cause\ncups-filters to crash, resulting in a denial of service, or possibly\nexecute arbitrary code. This issue only affected Ubuntu 16.04 LTS,\nUbuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. (CVE-2025-57812)\n\nIt was discovered that cups-filters incorrectly handled certain malformed\nPDF document files. A remote attacker could use this issue to cause\ncups-filters to crash, resulting in a denial of service, or possibly\nexecute arbitrary code. This issue only affected Ubuntu 16.04 LTS,\nUbuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. (CVE-2025-64503)\n\nIt was discovered that cups-filters incorrectly handled certain malformed\nCUPS Raster files. A remote attacker could use this issue to cause\ncups-filters to crash, resulting in a denial of service, or possibly\nexecute arbitrary code. (CVE-2025-64524)","status":"published","published":"2025-11-20T16:04:31Z","modified":"2026-06-25T13:32:31.450984536Z","updated_at":"2026-11-02T16:58:21.91885Z"}]}}