CVE-2025-64503
MediumCVSS 4.0Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
cups-filters contains backends, filters, and other software required to get the CUPS printing service working on operating systems other than macOS. In cups-filters prior to 1.28.18, by crafting a PDF file with a large MediaBox value, an attacker can cause CUPS-Filter 1.x's pdftoraster tool to write beyond the bounds of an array. First, a PDF with a large MediaBox width value causes header.cupsWidth to become large. Next, the calculation of bytesPerLine = (header.cupsBitsPerPixel * header.cupsWidth + 7) / 8 overflows, resulting in a small value. Then, lineBuf is allocated with the small bytesPerLine size. Finally, convertLineChunked calls writePixel8, which attempts to write to lineBuf outside of its buffer size (out of bounds write). In libcupsfilters, the maintainers found the same bytesPerLine multiplication without overflow check, but the provided test case does not cause an overflow there, because the values are different. Commit 50d94ca0f2fa6177613c97c59791bde568631865 contains a patch, which is incorporated into cups-filters version 1.28.18.
Risk Assessment
Potential memory corruption (out-of-bounds write) in the print processing path, which could lead to service crash or potentially code execution in the context of the printing process.
Recommendation
Update cups-filters to version 1.28.18 or later. Consider restricting the ability to submit PDF files for printing from untrusted sources.
Other vulnerabilities in cups-filters
See all- CVE-2015-3279High
Integer overflow in filter/texttopdf.c in cups-filters before 1.0.71 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted line size in a print job, which triggers a heap-based buffer overflow.
- CVE-2015-3258High
Heap-based buffer overflow in the WriteProlog function in filter/texttopdf.c in cups-filters before version 1.0.70 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a small line size in a print job.
- CVE-2015-2265High
The remove_bad_chars function in utils/cups-browsed.c in cups-filters before 1.0.66 allows remote IPP printers to execute arbitrary commands via consecutive shell metacharacters in the model or PDL.
- CVE-2014-2707High
Cups-browsed in cups-filters version 1.0.41 before 1.0.51 allows remote IPP printers to execute arbitrary commands via shell metacharacters in the model or PDL, related to System V interface scripts generated for queues.
- CVE-2025-64524Low
cups-filters versions 2.0.1 and prior contain a heap-buffer-overflow in the rastertopclx filter that causes a segmentation fault when processing maliciously crafted input. This can be exploited to trigger memory corruption, potentially leading to arbitrary code execution. The issue is patched via commit 956283c.
Original NVD description (English source)
cups-filters contains backends, filters, and other software required to get the cups printing service working on operating systems other than macos. In cups-filters prior to 1.28.18, by crafting a PDF file with a large `MediaBox` value, an attacker can cause CUPS-Filter 1.x’s `pdftoraster` tool to write beyond the bounds of an array. First, a PDF with a large `MediaBox` width value causes `header.cupsWidth` to become large. Next, the calculation of `bytesPerLine = (header.cupsBitsPerPixel * header.cupsWidth + 7) / 8` overflows, resulting in a small value. Then, `lineBuf` is allocated with the small `bytesPerLine` size. Finally, `convertLineChunked` calls `writePixel8`, which attempts to write to `lineBuf` outside of its buffer size (out of bounds write). In libcupsfilters, the maintainers found the same `bytesPerLine` multiplication without overflow check, but the provided test case does not cause an overflow there, because the values are different. Commit 50d94ca0f2fa6177613c97c59791bde568631865 contains a patch, which is incorporated into cups-filters version 1.28.18.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS