Read the docs
TI-2025-36152 Aliases CVE-2025-58364

cups: Remote DoS via null dereference

Priority MEDIUM 62CWE-20Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 13 fixed, 3 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-476.

Summary

OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.12 and earlier, an unsafe deserialization and validation of printer attributes causes null dereference in the libcups library. This is a remote DoS vulnerability available in local subnet in default configurations. It can cause the cups & cups-browsed to crash, on all the machines in local network who are listening for printers (so by default for all regular linux machines). On systems where the vulnerability CVE-2024-47176 (cups-filters 1.x/cups-browsed 2.x vulnerability) was not fixed, and the firewall on the machine does not reject incoming communication to IPP port, and the machine is set to be available to public internet, attack vector "Network" is possible. The current versions of CUPS and cups-browsed projects have the attack vector "Adjacent" in their default configurations. Version 2.4.13 contains a patch for CVE-2025-58364.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.0116 67th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial cups (OpenPrinting): 2.4.13Red Hat: 7 advisoriesRed Hat: 13 fixed, 3 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
OpenPrintingcupsbefore 2.4.132.4.13Patch availableCNA
  • cups VendorOpenPrinting Affected before 2.4.13 Fixed in 2.4.13 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:openprinting:cups:*:*:*:*:*:*:*:*before 2.4.13VulnerableOpenPrinting
  • cpe:2.3:a:openprinting:cups:*:*:*:*:*:*:*:* Versions before 2.4.13 Vulnerable ·OpenPrinting

Remediation

  • Fix · CNA cups (OpenPrinting) Fixed in 2.4.13

Red Hat 7 advisories

  • RHSA-2026:8814 Released 2026-04-17 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images cups-2.4.17-1.hum1@aarch64, cups-2.4.17-1.hum1@src, cups-2.4.17-1.hum1@x86_64 +14
  • RHSA-2025:22063 Released 2025-11-25 · Red Hat rating Moderate
    cups security update
    • Red Hat Enterprise Linux AppStream (v. 8) cups-1:2.2.6-64.el8_10, cups-client-1:2.2.6-64.el8_10, cups-devel-1:2.2.6-64.el8_10 +3
    • Red Hat Enterprise Linux BaseOS (v. 8) cups-1:2.2.6-64.el8_10, cups-libs-1:2.2.6-64.el8_10
  • RHSA-2025:16592 Released 2025-09-24 · Red Hat rating Important
    cups security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.4) cups-1:2.3.3op2-27.el9_4.1, cups-client-1:2.3.3op2-27.el9_4.1, cups-devel-1:2.3.3op2-27.el9_4.1 +4
    • Red Hat Enterprise Linux BaseOS EUS (v.9.4) cups-1:2.3.3op2-27.el9_4.1, cups-libs-1:2.3.3op2-27.el9_4.1
Show 4 more Red Hat advisories
  • RHSA-2025:16591 Released 2025-09-24 · Red Hat rating Important
    cups security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.2) cups-1:2.3.3op2-16.el9_2.4, cups-client-1:2.3.3op2-16.el9_2.4, cups-devel-1:2.3.3op2-16.el9_2.4 +4
    • Red Hat Enterprise Linux BaseOS E4S (v.9.2) cups-1:2.3.3op2-16.el9_2.4, cups-libs-1:2.3.3op2-16.el9_2.4
  • RHSA-2025:16590 Released 2025-09-24 · Red Hat rating Important
    cups security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.0) cups-1:2.3.3op2-13.el9_0.4, cups-client-1:2.3.3op2-13.el9_0.4, cups-devel-1:2.3.3op2-13.el9_0.4 +4
    • Red Hat Enterprise Linux BaseOS E4S (v.9.0) cups-1:2.3.3op2-13.el9_0.4, cups-libs-1:2.3.3op2-13.el9_0.4
  • RHSA-2025:15700 Released 2025-09-11 · Red Hat rating Important
    cups security update
    • Red Hat Enterprise Linux AppStream (v. 9) cups-1:2.3.3op2-33.el9_6.1, cups-client-1:2.3.3op2-33.el9_6.1, cups-devel-1:2.3.3op2-33.el9_6.1 +4
    • Red Hat Enterprise Linux BaseOS (v. 9) cups-1:2.3.3op2-33.el9_6.1, cups-libs-1:2.3.3op2-33.el9_6.1
  • RHSA-2025:15701 Released 2025-09-11 · Red Hat rating Important
    cups security update
    • Red Hat Enterprise Linux AppStream (v. 10) cups-1:2.4.10-11.el10_0.1, cups-client-1:2.4.10-11.el10_0.1, cups-devel-1:2.4.10-11.el10_0.1 +3
    • Red Hat Enterprise Linux BaseOS (v. 10) cups-1:2.4.10-11.el10_0.1, cups-filesystem-1:2.4.10-11.el10_0.1, cups-libs-1:2.4.10-11.el10_0.1

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 6AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 7AffectedNo fix yet: Fix deferred
Red Hat OpenShift Container Platform 4AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux AppStream (v. 10)Fixed RHSA-2025:15701
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2025:22063
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2025:15700
Red Hat Enterprise Linux AppStream E4S (v.9.0)Fixed RHSA-2025:16590
Red Hat Enterprise Linux AppStream E4S (v.9.2)Fixed RHSA-2025:16591
Red Hat Enterprise Linux AppStream EUS (v.9.4)Fixed RHSA-2025:16592
Red Hat Enterprise Linux BaseOS (v. 10)Fixed RHSA-2025:15701
Red Hat Enterprise Linux BaseOS (v. 8)Fixed RHSA-2025:22063
Red Hat Enterprise Linux BaseOS (v. 9)Fixed RHSA-2025:15700
Red Hat Enterprise Linux BaseOS E4S (v.9.0)Fixed RHSA-2025:16590
Red Hat Enterprise Linux BaseOS E4S (v.9.2)Fixed RHSA-2025:16591
Red Hat Enterprise Linux BaseOS EUS (v.9.4)Fixed RHSA-2025:16592
Red Hat Hardened ImagesFixed RHSA-2026:8814
Not affected: 4 products
  • Red Hat Enterprise Linux 10
  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-58364

References

Exploit 1

Patch 1

  • TI-2025-35903 cups has Authentication bypass with AuthType Negotiate CVSS 3.1HIGH 8.0
  • TI-2023-17077 CUPS vulnerable to use-after-free in cupsdAcceptClient() CVSS 3.1HIGH 7.1
  • TI-2026-27200 Path traversal in OpenPrinting cups CVSS 3.1MEDIUM 6.5
  • TI-2023-04157 OpenPrinting CUPS/libppd Postscript Parsing Heap Overflow CVSS 3.1HIGH 7.0
  • TI-2026-74874 Path traversal in OpenPrinting CUPS banner handling discloses files CVSS 3.1MEDIUM 5.3
  • TI-2026-27201 OpenPrinting CUPS: Heap overflow in `get_options()` CVSS 3.1MEDIUM 5.3
See all 24 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences