CVE-2025-61915 OpenPrinting CUPS vulnerable to stack based out-of-bound write
A user in the lpadmin group can trigger a stack-based out-of-bound write in the root-running cupsd process via the web UI, leading to code execution or privilege escalation.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-61915?
CVE-2025-61915 is a medium-severity memory corruption vulnerability in OpenPrinting cups, published on 29 Nov 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to version 2.4.15, a user in the lpadmin group can use the cups web ui to change the config and insert a malicious line. Then the cupsd process which runs as root will parse the new config and cause an out-of-bound write. This issue has been patched in version 2.4.15.
Which versions are affected by CVE-2025-61915?
It affects 1 product.
Linux distribution packages (1)
cups SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 | All versions | 1.7.5-20.57.1 |
Products include Openprinting Cups.
How do I fix CVE-2025-61915?
Upgrade to a fixed version.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2025-61915 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-61915 exists.
Other vulnerabilities in OpenPrinting cups
- CVE-2025-58060 cups has Authentication bypass with AuthType Negotiate
- CVE-2026-34978 Path traversal in cups
- CVE-2025-58364 cups: Remote DoS via null dereference
- CVE-2026-34980 OpenPrinting CUPS: Shared PostScript queue lets anonymous Print-Job requests reach `lp` code execution over the network
- CVE-2026-55480 CUPS copy_model() creates a predictable PPD tempfile without O_EXCL/O_NOFOLLOW (symlink TOCTOU, lp → root)
Sources
Also known as ALPINE-CVE-2025-61915, AZL-71146, AZL-71152, BELL-CVE-2025-61915, CLSA-2026-1769515411, CLSA-2026-1769516003 and 8 more.