CVE-2026-64612 Libcupsfilters: cups-filters: libcupsfilters: cups image filter process abort via malformed png
An unauthenticated attacker can cause a denial of service in the CUPS image filter process by submitting a specially crafted PNG print job.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-64612?
CVE-2026-64612 is a high-severity denial of service vulnerability in Red Hat Enterprise Linux 10, published on 20 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A flaw was found in libcupsfilters and cups-filters. The PNG image reading function creates a libpng reader without installing an error recovery handler, causing the CUPS image filter process to abort when processing a malformed PNG file. An unauthenticated attacker could exploit this by submitting a specially crafted PNG print job, leading to denial of service of the in-flight print job.
Weakness: CWE-248
Which versions are affected by CVE-2026-64612?
Linux distribution packages (10)
cups-filters AlmaLinux:8 | All versions | 1.20.0-36.el8_10.1 |
cups-filters-devel AlmaLinux:8 | All versions | 1.20.0-36.el8_10.1 |
cups-filters-libs AlmaLinux:8 | All versions | 1.20.0-36.el8_10.1 |
cups-filters AlmaLinux:9 | All versions | 1.28.7-27.el9_8 |
cups-filters-devel AlmaLinux:9 | All versions | 1.28.7-27.el9_8 |
cups-filters-libs AlmaLinux:9 | All versions | 1.28.7-27.el9_8 |
cups-filters-libs Red Hat:enterprise_linux:8::appstream | All versions | 0:1.20.0-36.el8_10.1 |
cups-filters-libs Red Hat:enterprise_linux:9::appstream | All versions | 0:1.28.7-27.el9_8 |
cups-filters Rocky Linux:8 | All versions | 0:1.20.0-36.el8_10.1 |
cups-filters Rocky Linux:9 | All versions | 0:1.28.7-27.el9_8 |
How do I fix CVE-2026-64612?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-64612 being exploited?
There is no known exploitation of CVE-2026-64612 in the wild and no public exploit code.
Sources
Also known as ALSA-2026:57451, ALSA-2026:58560, CLSA-2026-1787758219, CLSA-2026-1788362591, DEBIAN-CVE-2026-64612, GHSA-qfw8-cr83-3h6j and 6 more.