CVE-2026-64612: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-64612 is a denial-of-service vulnerability in libcupsfilters (through version 2.1.1) and cups-filters (through version 1.28.17) caused by the PNG image reading function failing to install a proper error recovery handler. When processing a malformed PNG file, the CUPS image filter process aborts via SIGABRT (exit 134), disrupting the in-flight print job. The vulnerability was published on July 20, 2026, and affects Red Hat Enterprise Linux and related distributions. It carries a CVSS v3.1 base score of 7.5 (High) (Github Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-248 (Uncaught Exception). Specifically, the _cfImageReadPNG() function (libcupsfilters 2.x) and _cupsImageReadPNG() function (cups-filters 1.x) in cupsfilters/image-png.c call png_create_read_struct(PNG_LIBPNG_VER_STRING, NULL, NULL, NULL) without providing a custom error handler or a setjmp(png_jmpbuf(pp)) recovery frame. When libpng encounters any parse error in the PNG data, its default error handler invokes abort(), terminating the filter process. An unauthenticated attacker can exploit this remotely with no user interaction by submitting a single specially crafted PNG image as a print job, triggering the crash in the imagetoraster or imagetopdf filter (Red Hat Bugzilla, Github Advisory).

Successful exploitation results in a denial of service limited to the availability of the CUPS image filter process — there is no confidentiality or integrity impact. An unauthenticated attacker can abort any in-flight PNG print job by submitting a malformed PNG, causing the imagetoraster or imagetopdf filter to crash with SIGABRT. While the impact is scoped to the print service and does not enable lateral movement or data exfiltration, repeated exploitation could persistently disrupt printing operations on affected systems (Github Advisory, Red Hat Bugzilla).

1. Reconnaissance: Identify systems running CUPS with libcupsfilters ≤ 2.1.1 or cups-filters ≤ 1.28.17 that accept network print jobs (e.g., via IPP on TCP port 631).
2. Craft malformed PNG: Create a PNG file with a deliberately malformed structure (e.g., invalid IHDR chunk, corrupted CRC, or truncated data) that will trigger a libpng parse error.
3. Submit print job: Submit the malformed PNG as an image print job to the target CUPS server using standard IPP print submission tools (e.g., lp, lpr, or a raw IPP request via curl).
4. Trigger abort: The _cfImageReadPNG() or _cupsImageReadPNG() function processes the PNG without a recovery handler; libpng's default error handler calls abort(), terminating the imagetoraster or imagetopdf filter process with SIGABRT (exit code 134), canceling the in-flight print job (Red Hat Bugzilla, Github Advisory).

• Logs: CUPS error log (/var/log/cups/error_log) entries showing filter process termination with exit code 134 (SIGABRT) for PNG print jobs; entries referencing imagetoraster or imagetopdf filter crashes.
• Process: Unexpected termination of imagetoraster or imagetopdf child processes of the CUPS scheduler (cupsd) with signal 6 (SIGABRT).
• Network: Repeated IPP print job submissions from the same source IP containing PNG payloads, particularly if jobs consistently fail at the filter stage.
• System: Core dump files generated in the CUPS working directory (if core dumps are enabled) associated with the imagetoraster or imagetopdf processes.

As of the disclosure date (July 20, 2026), no upstream fix is available for libcupsfilters or cups-filters (Red Hat Bugzilla). Administrators should monitor Red Hat security advisories for patched package releases. In the interim, consider restricting access to the CUPS print service to trusted network segments or authenticated users only, and configure firewall rules to limit IPP (TCP/631) exposure. Disabling PNG image job processing or filtering incoming print jobs for PNG content at the network or application layer may also reduce exposure until a patch is available (Github Advisory, Red Hat Bugzilla).