CVE-2025-58364: 
Rocky Linux vulnerability analysis and mitigation

OpenPrinting CUPS, an open source printing system for Linux and Unix-like operating systems, was found to contain a security vulnerability (CVE-2025-58364) in versions 2.4.12 and earlier. The vulnerability stems from an unsafe deserialization and validation of printer attributes that causes a null dereference in the libcups library. This vulnerability was discovered and disclosed on September 11, 2025, and has been assigned a CVSS v3.1 base score of 6.5 (Medium severity) (NVD, GitHub Advisory).

The vulnerability occurs in the ipp_read_io() function which is called internally by cupsDoRequest(). The issue manifests when processing specific combinations of printer attribute requests, particularly in the flow of ippNewRequest(IPP_OP_GET_PRINTER_ATTRIBUTES) followed by cupsDoRequest() and ippValidateAttributes(). The null dereference specifically happens in the line for (ptr = attr->values[i].string.text; *ptr; ptr++) when an attacker responds with a crafted printer attributes response. This vulnerability is present in two locations within OpenPrinting: cups/scheduler/ipp.c and libcupsfilters/cupsfilters/ipp.c (Openwall).

The vulnerability enables a remote Denial of Service (DoS) attack available in local subnet configurations. When successfully exploited, it can cause both cups and cups-browsed services to crash on all machines in the local network that are listening for printers, which is the default configuration for most Linux machines. On systems with unpatched CVE-2024-47176 (cups-filters 1.x/cups-browsed 2.x vulnerability) and exposed IPP ports to the internet, the attack vector extends to 'Network' rather than just 'Adjacent' (Security Online).

The vulnerability has been patched in CUPS version 2.4.13. Organizations and users are strongly advised to upgrade to this version or later. The fix involves modifying the handling of extension tags in the ipp_read_io() function. Multiple Linux distributions have released security updates addressing this vulnerability, including Ubuntu which has provided fixes across multiple versions of their operating system (Ubuntu Security, GitHub Patch).