CVE-2025-58364 Overview
CVE-2025-58364 affects OpenPrinting CUPS, the open source printing system used by most Linux and Unix-like operating systems. The vulnerability resides in the libcups library, which performs unsafe deserialization and validation of printer attributes. A malformed IPP extension tag triggers a null pointer dereference [CWE-20], crashing both cups and cups-browsed processes. Any Linux machine listening for printer announcements on the local subnet is vulnerable in default configurations. Systems where CVE-2024-47176 remains unpatched and expose IPP to the internet face a network-reachable attack vector. OpenPrinting released version 2.4.13 to address the flaw.
Critical Impact
Remote attackers on the adjacent network can crash CUPS and cups-browsed on all listening Linux hosts, disrupting printing services across an entire subnet.
Affected Products
- OpenPrinting CUPS versions 2.4.12 and earlier
- libcups library shipped with the affected CUPS versions
- cups-browsed service running on default Linux distributions
Discovery Timeline
- 2025-09-11 - CVE-2025-58364 published to NVD
- 2025-09-11 - OpenPrinting publishes GHSA-7qx3-r744-6qv4 security advisory and patch commit e58cba9d
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-58364
Vulnerability Analysis
The flaw lives in ipp_read_io() inside cups/ipp.c, the function responsible for parsing Internet Printing Protocol (IPP) responses. When a printer attribute uses the IPP_TAG_EXTENSION marker, libcups reads an additional 32-bit tag from the wire and passes the value into downstream processing without validating the resulting attribute state. A crafted response can leave attribute pointers unset, causing later dereferences to hit a null pointer and abort the process.
Because cups-browsed listens for printer announcements by default, an attacker on the same broadcast domain can trigger the crash on every subscribing host by advertising a malicious printer. The service terminates, which halts local print queues and browse discovery. On hosts still exposed to the earlier CVE-2024-47176 issue, the same payload can be delivered directly to UDP port 631 from the internet.
Root Cause
The root cause is missing input validation of the extension tag path in ipp_read_io(). The parser accepts the 32-bit extension value and continues execution even when the resulting attribute structure is incomplete, violating the invariants expected by later code.
Attack Vector
An attacker sends a crafted IPP packet or printer announcement to a target running cups-browsed. No authentication or user interaction is required. Delivery on the local subnet uses UDP broadcast to port 631. Internet delivery is possible only when IPP is directly reachable and CVE-2024-47176 remains unpatched.
// Security patch in cups/ipp.c - libcups: Fix handling of extension tag in ipp_read_io()
tag = (ipp_tag_t)buffer[0];
- if (tag == IPP_TAG_EXTENSION)
- {
- /*
- * Read 32-bit "extension" tag...
- */
-
- if ((*cb)(src, buffer, 4) < 4)
- {
- DEBUG_puts("1ipp_read_io: Callback returned EOF/error");
- goto rollback;
- }
-
- tag = (ipp_tag_t)((buffer[0] << 24) | (buffer[1] << 16) | (buffer[2] << 8) | buffer[3]);
-
- if (tag & IPP_TAG_CUPS_CONST)
- {
- /*
- * Fail if the high bit is set in the tag...
- */
-
- _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("IPP extension tag larger than 0x7FFFFFFF."), 1);
- DEBUG_printf(("1ipp_read_io: bad tag 0x%x.", tag));
- goto rollback;
- }
- }
if (tag == IPP_TAG_END)
// Source: https://github.com/OpenPrinting/cups/commit/e58cba9d6fceed4242980e51dbd1302cf638ab1d
The patch removes the unsafe extension-tag reading block entirely, eliminating the code path that produced the invalid attribute state.
Detection Methods for CVE-2025-58364
Indicators of Compromise
- Unexpected cupsd or cups-browsed process crashes recorded in /var/log/syslog or journalctl -u cups-browsed
- Segmentation fault entries referencing libcups.so in dmesg or the systemd journal
- Loss of network printer discovery across multiple hosts on the same subnet within a short window
Detection Strategies
- Alert on repeated restarts or abnormal exits of cups-browsed and cupsd services across endpoints
- Inspect inbound IPP traffic on UDP/631 for oversized or malformed extension tags advertised by unknown sources
- Correlate simultaneous CUPS crashes across hosts on the same VLAN as an indicator of subnet-scoped exploitation
Monitoring Recommendations
- Enable auditing on /var/log/cups/error_log and forward events to a centralized log platform for correlation
- Track systemd service state changes for cups.service and cups-browsed.service fleet-wide
- Monitor unauthorized hosts advertising IPP printers on internal subnets via passive network telemetry
How to Mitigate CVE-2025-58364
Immediate Actions Required
- Upgrade CUPS to version 2.4.13 or later, or apply the distribution backport referenced in the Debian LTS announcement
- Block inbound UDP and TCP traffic to port 631 from untrusted networks at the host firewall
- Disable cups-browsed on endpoints that do not require network printer discovery
Patch Information
OpenPrinting fixed the issue in CUPS 2.4.13 via commit e58cba9d6fceed4242980e51dbd1302cf638ab1d. Details are published in the OpenPrinting GitHub Security Advisory GHSA-7qx3-r744-6qv4. Downstream distribution packages are tracked in the Debian LTS Announcement and the OpenWall OSS Security post.
Workarounds
- Stop and mask cups-browsed.service where automatic printer discovery is not needed
- Restrict IPP traffic to trusted management VLANs using firewall rules such as iptables or nftables
- Ensure CVE-2024-47176 patches are applied to prevent internet-facing exposure of the same code path
# Disable cups-browsed and restrict IPP to the local host
sudo systemctl stop cups-browsed
sudo systemctl mask cups-browsed
sudo iptables -A INPUT -p udp --dport 631 ! -s 127.0.0.1 -j DROP
sudo iptables -A INPUT -p tcp --dport 631 ! -s 127.0.0.1 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
