OpenPrinting cups-filters/libcupsfilters pdftoraster out-of-bounds write

Summaryinfo

A vulnerability was found in OpenPrinting cups-filters and libcupsfilters. It has been declared as critical. The impacted element is an unknown function of the component pdftoraster. Such manipulation leads to out-of-bounds write. This vulnerability is referenced as CVE-2025-64503. The attack can only be performed from a local environment. No exploit is available. Applying a patch is advised to resolve this issue.

Detailsinfo

A vulnerability was found in OpenPrinting cups-filters and libcupsfilters (version now known) and classified as problematic. Affected by this issue is some unknown processing of the component pdftoraster. The manipulation with an unknown input leads to a out-of-bounds write vulnerability. Using CWE to declare the problem leads to CWE-787. The product writes data past the end, or before the beginning, of the intended buffer. Impacted is availability. CVE summarizes:

cups-filters contains backends, filters, and other software required to get the cups printing service working on operating systems other than macos. In cups-filters prior to 1.28.18, by crafting a PDF file with a large `MediaBox` value, an attacker can cause CUPS-Filter 1.x’s `pdftoraster` tool to write beyond the bounds of an array. First, a PDF with a large `MediaBox` width value causes `header.cupsWidth` to become large. Next, the calculation of `bytesPerLine = (header.cupsBitsPerPixel * header.cupsWidth + 7) / 8` overflows, resulting in a small value. Then, `lineBuf` is allocated with the small `bytesPerLine` size. Finally, `convertLineChunked` calls `writePixel8`, which attempts to write to `lineBuf` outside of its buffer size (out of bounds write). In libcupsfilters, the maintainers found the same `bytesPerLine` multiplication without overflow check, but the provided test case does not cause an overflow there, because the values are different. Commit 50d94ca0f2fa6177613c97c59791bde568631865 contains a patch, which is incorporated into cups-filters version 1.28.18.

The advisory is shared for download at seclists.org. This vulnerability is handled as CVE-2025-64503. The exploitation is known to be easy. The attack needs to be approached locally. There are neither technical details nor an exploit publicly available.

The vulnerability scanner Nessus provides a plugin with the ID 276527 (SUSE SLED15 / SLES15 / openSUSE 15 Security Update : cups-filters (SUSE-SU-2025:4158-1)), which helps to determine the existence of the flaw in a target environment.

Applying a patch is able to eliminate this problem.

The vulnerability is also documented in the databases at Tenable (276527), EUVD (EUVD-2025-150365) and CERT Bund (WID-SEC-2025-2598). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Affected

• Open Source CUPS

Productinfo

Type

• Printing Software

Vendor

• OpenPrinting

Name

• cups-filters
• libcupsfilters

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion