CVE-2025-58364: openprinting cups Improper Input Validation
Vulnerability summary
CVE-2025-58364 is a medium (CVSS 6.5) Improper Input Validation vulnerability in openprinting cups. EPSS estimates a 1.07% chance of exploitation in the next 30 days, higher than 64.2% of scored vulnerabilities. 1 public exploit is recorded.
Advisory lineage
Upstream 0 · Downstream 18 · Related 9Timeline
- 11-09-2025PublishedVulnerability first disclosed.
- 04-11-2025Last modifiedVulnerability information updated.
Description
OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.12 and earlier, an unsafe deserialization and validation of printer attributes causes null dereference in the libcups library. This is a remote DoS vulnerability available in local subnet in default configurations. It can cause the cups & cups-browsed to crash, on all the machines in local network who are listening for printers (so by default for all regular linux machines). On systems where the vulnerability CVE-2024-47176 (cups-filters 1.x/cups-browsed 2.x vulnerability) was not fixed, and the firewall on the machine does not reject incoming communication to IPP port, and the machine is set to be available to public internet, attack vector "Network" is possible. The current versions of CUPS and cups-browsed projects have the attack vector "Adjacent" in their default configurations. Version 2.4.13 contains a patch for CVE-2025-58364.
CVSS metrics
6 scores · 6 sources · 1 version- OSV · AlpineEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · Red hatEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · UbuntuEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- NVDNIST6.5MediumCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
1.07%
Chance of exploitation in the next 30 days
Percentile
64%
Versus all other CVEs
30-day change
0.00 pp
From 1.07% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundCups
Maturity: poc
Weaknesses
CWE · root cause- CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
- CWE-476NULL Pointer DereferenceThe product dereferences a pointer that it expects to be valid but is NULL.
Affected systems
Redhat13 products
- cups< 1:2.2.6-64.el8_10
- cups-client< 1:2.2.6-64.el8_10
- cups-client-debuginfo< 1:2.2.6-64.el8_10
- cups-debuginfo< 1:2.2.6-64.el8_10
- cups-debugsource< 1:2.2.6-64.el8_10
Alpine1 product
- cups< 2.4.16-r0 | < 2.4.13-r0
Debian1 product
- cups< 2.4.2-3+deb12u9 | < 2.4.10-3+deb13u1 | < 2.4.10-4
Openprinting1 product
- cups< 2.4.13
Ubuntu1 product
- cups< 2.1.3-4ubuntu0.11+esm9 | < 2.2.7-1ubuntu2.10+esm7 | < 2.3.1-9ubuntu1.9+esm1 | < 2.4.1op1-1ubuntu4.12 | < 2.4.7-1.2ubuntu7.4
5 vendors · 17 products
References
15 links- github.com/OpenPrinting/cups/security/advisories/GHSA-7qx3-r744-6qv4X Refsource CONFIRMARTICLEExploitVendor Advisory
