CVE-2026-64612: CUPS Filters PNG Processing DoS Vulnerability

CVE-2026-64612 Overview

A denial-of-service vulnerability exists in libcupsfilters and cups-filters, components of the OpenPrinting CUPS ecosystem responsible for converting print job data into printer-ready formats. The PNG image reading function instantiates a libpng reader without registering an error recovery handler. When the filter encounters a malformed PNG file, the underlying libpng error routine aborts the CUPS image filter process. An unauthenticated attacker can submit a crafted PNG print job to trigger the abort, disrupting the in-flight print job. The weakness is classified as [CWE-248] Uncaught Exception.

Critical Impact
An unauthenticated remote attacker can crash the CUPS image filter process by submitting a malformed PNG print job, resulting in denial of service against print workflows.

Affected Products

OpenPrinting libcupsfilters
OpenPrinting cups-filters
Linux distributions bundling the affected CUPS filter components (see Red Hat advisory)

Discovery Timeline

2026-07-20 - CVE-2026-64612 published to the National Vulnerability Database (NVD)
2026-07-21 - Last updated in NVD database

Technical Details for CVE-2026-64612

Vulnerability Analysis

The flaw resides in the PNG image reading path of libcupsfilters, which is used by CUPS to rasterize image print jobs. The function creates a libpng reader object but does not install a png_set_longjmp_fn error recovery handler. When libpng encounters a corrupt or malformed PNG structure, its default error handler calls abort(), terminating the calling process rather than returning control to the caller.

Because the CUPS filter process invoked by the print scheduler handles the parsing, the abort halts the current print job. The scope is limited to availability of the filter process handling the offending job, not confidentiality or integrity of data. The EPSS score reflects low observed exploitation activity, but the low complexity and lack of authentication requirements make opportunistic abuse plausible in environments exposing CUPS to untrusted networks.

Root Cause

The root cause is a missing libpng error callback registration. Without a setjmp/longjmp recovery target installed via png_set_longjmp_fn, any fatal libpng error propagates to the default handler, which terminates the process. This is a classic uncaught exception pattern [CWE-248] in C code that consumes libraries relying on non-local jumps for error handling.

Attack Vector

Exploitation requires the attacker to submit a print job containing a specially crafted PNG file to a vulnerable CUPS instance. No authentication or user interaction is required when CUPS accepts print jobs from the network. The attacker delivers the malformed PNG through any supported ingestion channel, and the filter process aborts during rasterization. The vulnerability manifests in the PNG image reading routine of libcupsfilters; refer to the GitHub Security Advisory GHSA-7mxj-cfq5-84ch for source-level detail.

Detection Methods for CVE-2026-64612

Indicators of Compromise

Repeated abnormal termination of CUPS filter processes (imagetopdf, imagetoraster, or equivalent) in system logs.
CUPS error_log entries indicating filter failures immediately after PNG print job submission.
Print jobs stuck in stopped or aborted state following ingestion of PNG payloads from untrusted senders.

Detection Strategies

Monitor CUPS error_log and journalctl -u cups for libpng error strings and filter crash messages correlated with inbound print jobs.
Alert on process termination signals (SIGABRT) originating from CUPS filter binaries.
Inspect IPP (Internet Printing Protocol) traffic for PNG document formats submitted from unexpected network sources.

Monitoring Recommendations

Track the rate of failed print jobs per source IP and per user to identify abuse patterns.
Forward CUPS logs to a centralized logging or SIEM platform for correlation across print servers.
Baseline normal print-job volumes so anomalous spikes of PNG jobs are visible for triage.

How to Mitigate CVE-2026-64612

Immediate Actions Required

Apply vendor updates for libcupsfilters and cups-filters as soon as distribution packages become available; consult the Red Hat CVE Details page for package status.
Restrict network exposure of CUPS by binding the service to loopback or trusted management networks only.
Enforce authentication for IPP endpoints that accept print jobs from users or systems outside the trusted zone.

Patch Information

The upstream fix installs a libpng error recovery handler in the PNG reading function of libcupsfilters so that malformed inputs return an error to the caller instead of aborting the process. Track the GitHub Security Advisory GHSA-7mxj-cfq5-84ch and the Red Hat Bug Report 2502801 for backported package versions.

Workarounds

Disable network listening in cupsd.conf by removing Listen directives for non-local interfaces and restarting cups.
Filter inbound IPP traffic at the host or network firewall to limit submitters to trusted print clients.
Where feasible, disallow PNG job submission by removing or restricting the PNG MIME handler in CUPS filter configuration until patches are applied.

bash

# Configuration example: restrict CUPS to localhost and require authentication
sudo sed -i 's/^Listen .*/Listen localhost:631/' /etc/cups/cupsd.conf
sudo systemctl restart cups

# Firewall example: block external IPP traffic
sudo iptables -A INPUT -p tcp --dport 631 ! -s 127.0.0.1 -j DROP