CVE-2025-61915: openprinting cups Buffer Underflow

Vulnerability summary

CVE-2025-61915 is a medium (CVSS 6.7) Buffer Underflow vulnerability in openprinting cups. EPSS estimates a 0.46% chance of exploitation in the next 30 days, higher than 38.6% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 29-11-2025
   PublishedVulnerability first disclosed.
2. 03-12-2025
   Last modifiedVulnerability information updated.

Description

OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to version 2.4.15, a user in the lpadmin group can use the cups web ui to change the config and insert a malicious line. Then the cupsd process which runs as root will parse the new config and cause an out-of-bound write. This issue has been patched in version 2.4.15.

• CWE-124Buffer Underwrite ('Buffer Underflow')The product writes to a buffer using an index or pointer that references a memory location prior to the beginning of the buffer.
• CWE-129Improper Validation of Array IndexThe product uses untrusted input when calculating or using an array index, but the product does not validate or incorrectly validates the index to ensure the index references a valid position within the array.