CVE-2026-64612: A flaw was found in libcupsfilters and cups-filters

This month

HIGH 7.5REMOTE

CVE-2026-64612 is a high-severity flaw (CVSS 7.5) affecting affected software. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

A flaw was found in libcupsfilters and cups-filters. The PNG image reading function creates a libpng reader without installing an error recovery handler, causing the CUPS image filter process to abort when processing a malformed PNG file. An unauthenticated attacker could exploit this by submitting a specially crafted PNG print job, leading to denial of service of the in-flight print job.

Why this priority

High severity
Remotely exploitable, no login, no user action

A fixed release or distro patch exists.

Risk facts

CVSS score	7.5 (High)
Attack vector	Network (remote)
Attack complexity	Low
Privileges needed	None
User interaction	None
EPSS exploit chance	0.7% (top 47%)
CISA exploited list	No
Weakness	CWE-248
Published	2026-07-20
Last modified	2026-10-24

Publisher (CNA): Red Hat, Inc.

Last updated 2026-10-24 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Timeline

2026-07-20 18:16 UTCPublished CVE record published
2026-10-24 16:10 UTCUpdated Record last modified

Exact fixes by distribution

Fedora 46 · sugar-clock · FIXED · 22.1-17.fc46 · FEDORA-2026-57948849df · source

sudo dnf upgrade --advisory=FEDORA-2026-57948849df

Fedora ELN · selinux-policy · FIXED · 45.23-1.eln159 · FEDORA-2026-3668c969a2 · source

sudo dnf upgrade --advisory=FEDORA-2026-3668c969a2

Debian 12 · cups-filters · NO FIX YET

Debian 13 · cups-filters · NO FIX YET

Debian 13 · libcupsfilters · NO FIX YET

RHEL 10 · libcupsfilters · FIXED · libcupsfilters-2.0.0-13.el10_2

sudo dnf upgrade --advisory=RHSA-2026:56965 rpm -q libcupsfilters

RHEL 8 · cups-filters · FIXED · cups-filters-1.20.0-36.el8_10.1

sudo dnf upgrade --advisory=RHSA-2026:57451 rpm -q cups-filters

RHEL 9 · cups-filters · FIXED · cups-filters-1.28.7-27.el9_8

sudo dnf upgrade --advisory=RHSA-2026:58560 rpm -q cups-filters

RHEL 10 · cups-filters · NOT AFFECTED

RHEL 7 · cups-filters · DEFERRED

Amazon Linux 2023 · see advisory · FIXED · ALAS2023-2026-2127 · source

sudo dnf update --advisory=ALAS2023-2026-2127

Amazon Linux 2 · see advisory · FIXED · ALAS2-2026-3901 · source

sudo yum update --advisory=ALAS2-2026-3901

Public exploits and detection

Public code exists for this CVE. Treat unpatched systems as at risk, and only run PoCs in a lab.

Write-up: github.com/OpenPrinting/libcupsfilters/security/advisories/GHSA-7mxj-cfq5-84ch

Advisories and coverage

Official advisories

Amazon Linux 2 ALAS: ALAS2-2026-3901 (medium): cups-filters 2026-09-14

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2026-64612?

No fixed release is listed yet. Watch the vendor advisory and apply any mitigation shown on this page.

Is CVE-2026-64612 being exploited?

CVE-2026-64612 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2026-64612 affect?

CVE-2026-64612 affects affected software. Severity is high (CVSS 7.5). A flaw was found in libcupsfilters and cups-filters. The PNG image reading function creates a libpng reader without installing an error recovery handler, causing the CUPS image filter process to abort when processing a malformed PNG file. A

How urgent is CVE-2026-64612?

Priority 44/100. High severity; Remotely exploitable, no login, no user action

Software pages

libpng vulnerabilities

References

← Back to latest CVEs