Read the docs
TI-2026-46174 Aliases CVE-2026-64612GHSA-qfw8-cr83-3h6j

Libcupsfilters: cups-filters: libcupsfilters: cups image filter process abort via malformed png

Priority MEDIUM 40CWE-248Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 3 fixed, 1 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-248.

Summary

A flaw was found in libcupsfilters and cups-filters. The PNG image reading function creates a libpng reader without installing an error recovery handler, causing the CUPS image filter process to abort when processing a malformed PNG file. An unauthenticated attacker could exploit this by submitting a specially crafted PNG print job, leading to denial of service of the in-flight print job.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00704 53rd percentileScored 2026-11-07
Fix Partial Red Hat: 3 advisoriesRed Hat: 3 fixed, 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Red HatRed Hat Enterprise Linux 10—1:2.0.0-13.el10_2Patch availableCNA
Red HatRed Hat Enterprise Linux 8—1.20.0-36.el8_10.1Patch availableCNA
Red HatRed Hat Enterprise Linux 9—1.28.7-27.el9_8Patch availableCNA
Red HatRed Hat Enterprise Linux 10——Not affectedCNA
Red HatRed Hat Enterprise Linux 7——No fix listedCNA
  • Red Hat Enterprise Linux 10 VendorRed Hat Affected — Fixed in 1:2.0.0-13.el10_2 Patch available CNA
  • Red Hat Enterprise Linux 8 VendorRed Hat Affected — Fixed in 1.20.0-36.el8_10.1 Patch available CNA
  • Red Hat Enterprise Linux 9 VendorRed Hat Affected — Fixed in 1.28.7-27.el9_8 Patch available CNA
  • Red Hat Enterprise Linux 10 VendorRed Hat Affected — Fixed in — Not affected CNA
  • Red Hat Enterprise Linux 7 VendorRed Hat Affected — Fixed in — No fix listed CNA

CPE names CNA · 7

CPEVersionsRoleVendor
cpe:/o:redhat:enterprise_linux:10.210.2—Red Hat
cpe:/a:redhat:enterprise_linux:8::appstream8—Red Hat
cpe:/a:redhat:enterprise_linux:8::crb8—Red Hat
cpe:/a:redhat:enterprise_linux:9::appstream9—Red Hat
cpe:/a:redhat:enterprise_linux:9::crb9—Red Hat
cpe:/a:redhat:enterprise_linux:1010—Red Hat
cpe:/o:redhat:rhel_els:77—Red Hat
  • cpe:/o:redhat:enterprise_linux:10.2 Versions 10.2 — ·Red Hat
  • cpe:/a:redhat:enterprise_linux:8::appstream Versions 8 — ·Red Hat
  • cpe:/a:redhat:enterprise_linux:8::crb Versions 8 — ·Red Hat
  • cpe:/a:redhat:enterprise_linux:9::appstream Versions 9 — ·Red Hat
  • cpe:/a:redhat:enterprise_linux:9::crb Versions 9 — ·Red Hat
  • cpe:/a:redhat:enterprise_linux:10 Versions 10 — ·Red Hat
  • cpe:/o:redhat:rhel_els:7 Versions 7 — ·Red Hat

Remediation

Red Hat 3 advisories

  • RHSA-2026:58560 Released 2026-08-24 · Red Hat rating Moderate
    cups-filters security update
    • Red Hat Enterprise Linux AppStream (v. 9) cups-filters-libs-1.28.7-27.el9_8
  • RHSA-2026:57451 Released 2026-08-20 · Red Hat rating Moderate
    cups-filters security update
    • Red Hat Enterprise Linux AppStream (v. 8) cups-filters-libs-1.20.0-36.el8_10.1
  • RHSA-2026:56965 Released 2026-08-19 · Red Hat rating Moderate
    libcupsfilters security update
    • Red Hat Enterprise Linux AppStream (v. 10) libcupsfilters-1:2.0.0-13.el10_2

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7 and 2 more products — RHSA-2026:56965

    2 records Highest priority Priority MEDIUM 2 MEDIUM

    Other records, highest priority first

    • TI-2026-46173 Libcupsfilters: cups-filters: libcupsfilters: cpu exhaustion via infinite loop in cfieee1284normalizemakemodel()Priority MEDIUM 40
    Show all 2 records → Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 7AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux AppStream (v. 10)Fixed RHSA-2026:56965
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2026:57451
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2026:58560
Not affected: 6 products
  • Red Hat Enterprise Linux 10
  • Red Hat Enterprise Linux AppStream (v. 10)
  • Red Hat Enterprise Linux AppStream (v. 8)
  • Red Hat Enterprise Linux AppStream (v. 9)
  • Red Hat Enterprise Linux CRB (v. 8)
  • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-64612
  2. 2026-10-03 Alias added: GHSA-qfw8-cr83-3h6j

References

Advisory 3

Other 3

  • TI-2019-15875 Protection mechanism failure in Jenkins Pipeline: Groovy Plugin KEVCVSS 3.1CRITICAL 9.9
  • TI-2019-15874 Protection mechanism failure in Jenkins Script Security Plugin KEVCVSS 3.1CRITICAL 9.9
  • TI-2019-08259 Underflow in PHP-FPM can lead to RCE KEVCVSS 3.1CRITICAL 9.8
  • TI-2019-05363 Code injection in Elastic Kibana KEVCVSS 3.1CRITICAL 10.0
  • TI-2019-03949 Out-of-bounds write in ESXi and Horizon DaaS KEVCVSS 3.1CRITICAL 9.8
  • TI-2018-16080 A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153… KEVCVSS 3.1CRITICAL 9.8
See all 7413 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences