Skip to content
Fencer Intel
low 3.7

CVE-2025-57812 json

[BIGSLEEP-434612419] CUPS-Filters has heap-buffer-overflow write in `cfImageLut()`

published 11mo ago modified 22d ago also EUVD-2025-150402

cvss
3.7
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.5%
EPSS 0.5% chance of exploitation in 30 days, percentile 41%
public exploits
0
none known

Summary

CUPS is a standards-based, open-source printing system, and `libcupsfilters` contains the code of the filters of the former `cups-filters` package as library functions to be used for the data format conversion tasks needed in Printer Applications. In CUPS-Filters versions up to and including 1.28.17 and libscupsfilters versions 2.0.0 through 2.1.1, CUPS-Filters's `imagetoraster` filter has an out of bounds read/write vulnerability in the processing of TIFF image files. While the pixel buffer is allocated with the number of pixels times a pre-calculated bytes-per-pixel value, the function which processes these pixels is called with a size of the number of pixels times 3. When suitable inputs are passed, the bytes-per-pixel value can be set to 1 and bytes outside of the buffer bounds get processed. In order to trigger the bug, an attacker must issue a print job with a crafted TIFF file, and pass appropriate print job options to control the bytes-per-pixel value of the output format. They must choose a printer configuration under which the `imagetoraster` filter or its C-function equivalent `cfFilterImageToRaster()` gets invoked. The vulnerability exists in both CUPS-Filters 1.x and the successor library libcupsfilters (CUPS-Filters 2.x). In CUPS-Filters 2.x, the vulnerable function is `_cfImageReadTIFF() in libcupsfilters`. When this function is invoked as part of `cfFilterImageToRaster()`, the caller passes a look-up-table during whose processing the out of bounds memory access happens. In CUPS-Filters 1.x, the equivalent functions are all found in the cups-filters repository, which is not split into subprojects yet, and the vulnerable code is in `_cupsImageReadTIFF()`, which is called through `cupsImageOpen()` from the `imagetoraster` tool. A patch is available in commit b69dfacec7f176281782e2f7ac44f04bf9633cfa.

Patch / fix

  • cups-filters Debian 12 1.28.17-3+deb12u2
  • cups-filters Debian 13 1.28.17-6+deb13u1
  • cups-filters Debian 14 1.28.17-7
  • libcupsfilters Debian 13 2.0.0-3+deb13u1
  • libcupsfilters Debian 14 2.1.1-2

debian advisories DEBIAN-CVE-2025-57812

  • cups-filters Ubuntu 22.04 LTS 1.28.15-0ubuntu1.5
  • libcupsfilters Ubuntu 24.04 LTS 2.0.0-0ubuntu7.2
  • libcupsfilters Ubuntu 25.10 2.1.1-0ubuntu3.1
  • cups-filters Ubuntu Pro 16.04 LTS 1.8.3-2ubuntu3.5+esm3
  • cups-filters Ubuntu Pro 18.04 LTS 1.20.2-0ubuntu3.3+esm2
  • cups-filters Ubuntu Pro 20.04 LTS 1.27.4-1ubuntu0.4+esm1

ubuntu advisories UBUNTU-CVE-2025-57812

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • cups hummingbird 1 2.4.17-1.hum1
  • cups-lpd hummingbird 1 2.4.17-1.hum1
  • cups-libs hummingbird 1 2.4.17-1.hum1
  • cups-client hummingbird 1 2.4.17-1.hum1
  • cups-ipptool hummingbird 1 2.4.17-1.hum1
  • cups-filesystem hummingbird 1 2.4.17-1.hum1
  • cups-printerapp hummingbird 1 2.4.17-1.hum1

red hat advisories RHSA-2026:8814

  • cups-filters SLE Module for Basesystem 15 SP7, SLE Module for Basesystem 15 SP6, openSUSE Leap 15.6 1.25.0-150200.3.25.1
  • cups-filters SLES LTSS Extended Security 12 SP5 1.0.58-19.35.1

suse advisories SUSE-SU-2025:4198-1SUSE-SU-2025:4158-1

Is CVE-2025-57812 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2025-57812 updated cvss 3.7

cups: CUPS-Filters: Information disclosure and data corruption via crafted TIFF image file processing

  • Red Hat Enterprise Linux 7 cups-filters, cups-filters-libs Red Hat Enterprise Linux 8 cups-filters, cups-filters-libs Red Hat Enterprise Linux 9 cups-filters, cups-filters-libs Red Hat Enterprise Linux 10 cups-filters, libcupsfilters
    affected: workaround, no fix available “Fix deferred”
  • Red Hat Hardened Images cups 2.4.17-1.hum1, cups-lpd 2.4.17-1.hum1, cups-libs 2.4.17-1.hum1, cups-client 2.4.17-1.hum1, cups-ipptool 2.4.17-1.hum1, cups-filesystem 2.4.17-1.hum1, +1 more
    fixed: vendor fix RHSA-2026:8814

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
11mo ago

Exploit prediction

0.48% chance of exploitation in the next 30 days, higher than 41% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

  • github.com https://github.com/OpenPrinting/libcupsfilters/security/advisories/GHSA-jpxg-qc2c-hgv4 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 3.7 CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
NVD 3.1 3.7 CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

Affected products

  • OpenPrinting libcupsfilters

Classification

Weakness

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.