Fluid Attacks Database

Description

A flaw was found in libcupsfilters and cups-filters. The PNG image reading function creates a libpng reader without installing an error recovery handler, causing the CUPS image filter process to abort when processing a malformed PNG file. An unauthenticated attacker could exploit this by submitting a specially crafted PNG print job, leading to denial of service of the in-flight print job.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
rpm rhel7	cups-filters	-	-
rpm rhel9	cups-filters	<0:1.28.7-27.el9_8	0:1.28.7-27.el9_8
rpm rhel10	libcupsfilters	<1:2.0.0-13.el10_2	1:2.0.0-13.el10_2
debian 12	cups-filters	=1.28.17-3 \|\| =1.28.17-3+deb12u1 \|\| =1.28.17-3+deb12u2 \|\| =1.28.17-3.1 \|\| =1.28.17-3.1~exp1 \|\| =1.28.17-4 \|\| =1.28.17-4.1 \|\| =1.28.17-5 \|\| =1.28.17-6 \|\| =1.28.17-7	-
debian 14	cups-filters	=1.28.17-6 \|\| =1.28.17-7	-
debian 14	libcupsfilters	=2.0.0-3 \|\| =2.1.1-1 \|\| =2.1.1-2	-
debian 13	cups-filters	=1.28.17-6 \|\| =1.28.17-6+deb13u1 \|\| =1.28.17-7	-
rpm rhel8	cups-filters	<0:1.20.0-36.el8_10.1	0:1.20.0-36.el8_10.1
debian 13	libcupsfilters	=2.0.0-3 \|\| =2.0.0-3+deb13u1 \|\| =2.1.1-1 \|\| =2.1.1-2	-

Aliases

1. CVE-2026-646122. NVD-2026-646123. OSV-2026-646124. OSV-DEBIAN-2026-646125. SECURITY-TRACKER-CVE-2026-64612

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.