Skip to content
Fencer Vulns
medium 4.0

CVE-2025-64503 json

[BIGSLEEP-434615384] cups-filters 1.x: out of bounds write in pdftoraster

published 2025-11-12 11 mo ago modified 2026-10-18 21 d ago also EUVD-2025-150365

cvss
4.0
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.2%
EPSS 0.2% chance of exploitation in 30 days, percentile 13%
public exploits
0
none known

Summary

cups-filters contains backends, filters, and other software required to get the cups printing service working on operating systems other than macos. In cups-filters prior to 1.28.18, by crafting a PDF file with a large `MediaBox` value, an attacker can cause CUPS-Filter 1.x’s `pdftoraster` tool to write beyond the bounds of an array. First, a PDF with a large `MediaBox` width value causes `header.cupsWidth` to become large. Next, the calculation of `bytesPerLine = (header.cupsBitsPerPixel * header.cupsWidth + 7) / 8` overflows, resulting in a small value. Then, `lineBuf` is allocated with the small `bytesPerLine` size. Finally, `convertLineChunked` calls `writePixel8`, which attempts to write to `lineBuf` outside of its buffer size (out of bounds write). In libcupsfilters, the maintainers found the same `bytesPerLine` multiplication without overflow check, but the provided test case does not cause an overflow there, because the values are different. Commit 50d94ca0f2fa6177613c97c59791bde568631865 contains a patch, which is incorporated into cups-filters version 1.28.18.

Patch / fix

  • openprinting cups-filters 1.28.18
  • openprinting libcupsfilters 2.1.2
  • cups-filters Debian 12 1.28.17-3+deb12u2
  • cups-filters Debian 13 1.28.17-6+deb13u1
  • cups-filters Debian 14 1.28.17-7
  • libcupsfilters Debian 13 2.0.0-3+deb13u1
  • libcupsfilters Debian 14 2.1.1-2

debian advisories DEBIAN-CVE-2025-64503

  • cups-filters Ubuntu 22.04 LTS 1.28.15-0ubuntu1.5
  • libcupsfilters Ubuntu 24.04 LTS 2.0.0-0ubuntu7.2
  • libcupsfilters Ubuntu 25.10 2.1.1-0ubuntu3.1
  • cups-filters Ubuntu Pro 16.04 LTS 1.8.3-2ubuntu3.5+esm3
  • cups-filters Ubuntu Pro 18.04 LTS 1.20.2-0ubuntu3.3+esm2
  • cups-filters Ubuntu Pro 20.04 LTS 1.27.4-1ubuntu0.4+esm1

ubuntu advisories UBUNTU-CVE-2025-64503

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • cups hummingbird 1 2.4.17-1.hum1
  • cups-lpd hummingbird 1 2.4.17-1.hum1
  • cups-libs hummingbird 1 2.4.17-1.hum1
  • cups-client hummingbird 1 2.4.17-1.hum1
  • cups-ipptool hummingbird 1 2.4.17-1.hum1
  • cups-filesystem hummingbird 1 2.4.17-1.hum1
  • cups-printerapp hummingbird 1 2.4.17-1.hum1

red hat advisories RHSA-2026:8814

  • cups-filters SLE Module for Basesystem 15 SP7, SLE Module for Basesystem 15 SP6, openSUSE Leap 15.6 1.25.0-150200.3.25.1
  • cups-filters SLES LTSS Extended Security 12 SP5 1.0.58-19.35.1

suse advisories SUSE-SU-2025:4198-1SUSE-SU-2025:4158-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2025-64503 updated cvss 4.0

cups: cups-filters: cups-filters: Out-of-bounds write via crafted PDF MediaBox

  • Red Hat Enterprise Linux 7 cups-filters, cups-filters-libs Red Hat Enterprise Linux 8 cups-filters, cups-filters-libs Red Hat Enterprise Linux 9 cups-filters, cups-filters-libs Red Hat Enterprise Linux 10 cups-filters
    affected: no fix available “Fix deferred”
  • Red Hat Hardened Images cups 2.4.17-1.hum1, cups-lpd 2.4.17-1.hum1, cups-libs 2.4.17-1.hum1, cups-client 2.4.17-1.hum1, cups-ipptool 2.4.17-1.hum1, cups-filesystem 2.4.17-1.hum1, +1 more
    fixed: vendor fix RHSA-2026:8814

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
no
Technical impact
partial
Assessed
11 mo ago

Exploit prediction

0.23% chance of exploitation in the next 30 days, higher than 13% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/OpenPrinting/cups-filters/security/advisories/GHSA-893j-2wr2-wrh9 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 4.0 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
NVD 3.1 3.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

Affected products

  • OpenPrinting cups-filters

Classification

Weakness

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.