Infinite loop in libcupsfilters - CVE-2026-64611

Vulnerability identifier: #VU139342

CSH Severity: Medium

CVSS v4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-64611

CWE-ID: CWE-835

Exploitation vector: Adjecent network

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an infinite loop in cfIEEE1284NormalizeMakeModel when processing an IEEE-1284 device ID with an empty MDL field. A remote attacker can advertise or inject a crafted device ID to cause a denial of service.

Network delivery is possible through printer discovery via IPP or DNS-SD, and the affected consumer can hang on one CPU core indefinitely.

libcupsfilters
SUSE Linux Enterprise Server 12 SP5 LTSS Extended
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Desktop 15
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64
Basesystem Module
Fedora
cups-filters-cups-browsed-debuginfo
cups-filters-ghostscript
cups-filters-ghostscript-debuginfo
cups-filters-debugsource
cups-filters-debuginfo
cups-filters-foomatic-rip
cups-filters-cups-browsed
cups-filters
cups-filters-foomatic-rip-debuginfo
cups-filters-devel
libcupsfilters (Red Hat package)
libcupsfilters

Install security update from vendor's website.

libcupsfilters - update to 2.1.2
cups-filters-cups-browsed-debuginfo - update to 1.0.58-19.38.1
cups-filters-ghostscript - update to 1.0.58-19.38.1
cups-filters-ghostscript-debuginfo - update to 1.0.58-19.38.1
cups-filters-debugsource - addressed in versions 1.0.58-19.38.1, 1.25.0-150200.3.31.1
cups-filters-debuginfo - addressed in versions 1.0.58-19.38.1, 1.25.0-150200.3.31.1
cups-filters-foomatic-rip - update to 1.0.58-19.38.1
cups-filters-cups-browsed - update to 1.0.58-19.38.1
cups-filters - addressed in versions 1.0.58-19.38.1, 1.25.0-150200.3.31.1
cups-filters-foomatic-rip-debuginfo - update to 1.0.58-19.38.1
cups-filters-devel - update to 1.25.0-150200.3.31.1
libcupsfilters (Red Hat package) - update to 2.0.0-13.el10_2
libcupsfilters - addressed in versions 2.1.1-9.fc43, 2.1.1-9.fc44, 2.1.1-9.fc45, 2.2.0-1.fc45, 2.2.1-1.fc45, 2.2.1-1.fc46

• https://github.com/OpenPrinting/libcupsfilters/security/advisories/GHSA-rcq7-rv5g-j3r4
• https://github.com/OpenPrinting/libcupsfilters/commit/4b343522823403df01f6753082df83f07d18c217

• Multiple vulnerabilities in OpenPrinting cups-filters and libcupsfilters
• Fedora 43 update for libcupsfilters
• Fedora 45 update for libcupsfilters
• Fedora 44 update for libcupsfilters
• Fedora 45 update for libcupsfilters
• Fedora 46 update for libcupsfilters
• Fedora 45 update for libcupsfilters
• Red Hat Enterprise Linux 10 update for libcupsfilters
• SUSE update for cups-filters
• SUSE update for cups-filters