CVE-2025-64503: cups-filters contains backends, filters, and other software required to get the cups printing service working

Routine

MEDIUM 4.0UPGRADEUPGRADE

CVE-2025-64503 is a medium-severity flaw (CVSS 4.0) affecting cups-filters, libcupsfilters. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

cups-filters contains backends, filters, and other software required to get the cups printing service working on operating systems other than macos. In cups-filters prior to 1.28.18, by crafting a PDF file with a large `MediaBox` value, an attacker can cause CUPS-Filter 1.x’s `pdftoraster` tool to write beyond the bounds of an array. First, a PDF with a large `MediaBox` width value causes `header.cupsWidth` to become large. Next, the calculation

Why this priority

Public exploit reference

A fixed release or distro patch exists.

Risk facts

CVSS score	4.0 (Medium)
Attack vector	Local
Attack complexity	Low
Privileges needed	None
User interaction	None
EPSS exploit chance	0.2% (top 86%)
CISA exploited list	No
Weakness	CWE-787
Published	2025-11-12
Last modified	2026-10-18

Publisher (CNA): GitHub, Inc. · Vendor: openprinting

Last updated 2026-10-18 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2025-11-12 22:15 UTCPublished CVE record published
2026-10-18 20:10 UTCUpdated Record last modified

openprinting cups-filters UPGRADE

Affected: < 1.28.18

Fixed in: 1.28.18

Safe to downgrade to: no unaffected older release

1. Check installed version

apt-cache policy cups-filters || rpm -q cups-filters || cups-filters --version

2. UPGRADE to 1.28.18 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade cups-filters

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade cups-filters

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

openprinting libcupsfilters UPGRADE

Affected: >= 2.0.0 and < 2.1.2

Fixed in: 2.1.2

Safe to downgrade to: a release before 2.0.0

1. Check installed version

apt-cache policy libcupsfilters || rpm -q libcupsfilters || libcupsfilters --version

2. UPGRADE to 2.1.2 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade libcupsfilters

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade libcupsfilters

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

3. If no update is available yet, DOWNGRADE to a release before 2.0.0 (Debian / Ubuntu)

apt-cache madison libcupsfilters sudo apt install libcupsfilters=<VERSION_BEFORE_2.0.0> sudo apt-mark hold libcupsfilters

3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list libcupsfilters sudo dnf downgrade libcupsfilters-<VERSION_BEFORE_2.0.0> sudo dnf versionlock add libcupsfilters

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2025-64503?

cups-filters: upgrade to 1.28.18; libcupsfilters: upgrade to 2.1.2. Exact commands for each OS are on this page.

Is CVE-2025-64503 being exploited?

CVE-2025-64503 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2025-64503 affect?

CVE-2025-64503 affects cups-filters, libcupsfilters. Severity is medium (CVSS 4.0). cups-filters contains backends, filters, and other software required to get the cups printing service working on operating systems other than macos. In cups-filters prior to 1.28.18, by crafting a PDF file with a large `MediaBox` value, an

How urgent is CVE-2025-64503?

Priority 22/100. Public exploit reference

Software pages

macOS vulnerabilities

Related CVEs

CVE-2025-57812 LOW 3.7 UPGRADE UPGRADE CUPS is a standards-based, open-source printing system, and `libcupsfilters` contains the code of the filters
CVE-2025-64524 LOW 3.3 UPGRADE cups-filters contains backends, filters, and other software required to get the cups printing service working
CVE-2023-24805 HIGH 8.8 UPGRADE MITIGATE cups-filters contains backends, filters, and other software required to get the cups printing service working

References

← Back to latest CVEs