CVE-2026-64612: cups-filters Uncaught Exception
Vulnerability summary
CVE-2026-64612 is a high (CVSS 7.5) Uncaught Exception vulnerability in cups-filters. EPSS estimates a 0.70% chance of exploitation in the next 30 days, higher than 52.4% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 10 · Related 8Timeline
- 20-07-2026PublishedVulnerability first disclosed.
- 24-08-2026Last modifiedVulnerability information updated.
Description
A flaw was found in libcupsfilters and cups-filters. The PNG image reading function creates a libpng reader without installing an error recovery handler, causing the CUPS image filter process to abort when processing a malformed PNG file. An unauthenticated attacker could exploit this by submitting a specially crafted PNG print job, leading to denial of service of the in-flight print job.
CVSS metrics
5 scores · 5 sources · 1 version- OSV · Red hatEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
0.70%
Chance of exploitation in the next 30 days
Percentile
52%
Versus all other CVEs
30-day change
+0.32 pp
From 0.38% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Debian2 products
- cups-filtersAll versions (No fix recorded)
- libcupsfiltersAll versions (No fix recorded)
Ubuntu2 products
- cups-filtersAll versions (No fix recorded)
- libcupsfiltersAll versions (No fix recorded)
Redhat1 product
- cups-filters-libs< 0:1.20.0-36.el8_10.1 | < 0:1.28.7-27.el9_8
3 vendors · 5 products
