Skip to content
OpenAdvisories
Medium · 4.0 CVE-2025-64503 EUVD-2025-150365

[BIGSLEEP-434615384] cups-filters 1.x: out of bounds write in pdftoraster

Published Nov 12, 2025 · Updated Nov 13, 2025 · Assigned by GitHub_M

Description

cups-filters contains backends, filters, and other software required to get the cups printing service working on operating systems other than macos. In cups-filters prior to 1.28.18, by crafting a PDF file with a large `MediaBox` value, an attacker can cause CUPS-Filter 1.x’s `pdftoraster` tool to write beyond the bounds of an array. First, a PDF with a large `MediaBox` width value causes `header.cupsWidth` to become large. Next, the calculation of `bytesPerLine = (header.cupsBitsPerPixel * header.cupsWidth + 7) / 8` overflows, resulting in a small value. Then, `lineBuf` is allocated with the small `bytesPerLine` size. Finally, `convertLineChunked` calls `writePixel8`, which attempts to write to `lineBuf` outside of its buffer size (out of bounds write). In libcupsfilters, the maintainers found the same `bytesPerLine` multiplication without overflow check, but the provided test case does not cause an overflow there, because the values are different. Commit 50d94ca0f2fa6177613c97c59791bde568631865 contains a patch, which is incorporated into cups-filters version 1.28.18.

Affected products

VendorProductAffectedFixed
OpenPrinting cups-filters cups-filters < 1.28.18, libcupsfilters >= 2.0.0, < 2.1.2 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 cups-filters 1.28.17-7 —
Debian 14 libcupsfilters 2.1.1-2 —
Debian 13 cups-filters 1.28.17-6+deb13u1 —
Debian 13 libcupsfilters 2.0.0-3+deb13u1 —
Debian 12 cups-filters 1.28.17-3+deb12u2 —
Debian 11 cups-filters 1.28.7-1+deb11u4 DLA-4380-1
ReleasePackageFixed inAdvisory
Ubuntu 25.10 cups-filters 2.0.1-0ubuntu3.25.10.1 USN-7878-1
Ubuntu 25.10 libcupsfilters 2.1.1-0ubuntu3.1 USN-7877-1
Ubuntu 24.04 LTS cups-filters 2.0.0-0ubuntu4.1 USN-7878-1
Ubuntu 24.04 LTS libcupsfilters 2.0.0-0ubuntu7.2 USN-7877-1
Ubuntu 22.04 LTS cups-filters 1.28.15-0ubuntu1.5 USN-7878-1
Show 3 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 20.04 LTS cups-filters 1.27.4-1ubuntu0.4+esm1 USN-7878-1
Ubuntu Pro 18.04 LTS cups-filters 1.20.2-0ubuntu3.3+esm2 USN-7878-1
Ubuntu Pro 16.04 LTS cups-filters 1.8.3-2ubuntu3.5+esm3 USN-7878-1
ReleasePackageFixed inAdvisory
Red Hat Hardened Images 1 cups +7 2.4.17-1.hum1 RHSA-2026:8814
ReleasePackageFixed inAdvisory
SLES 15 SP7 cups-filters 1.25.0-150200.3.25.1 SUSE-SU-2025:4158-1
SLES 15 SP6 cups-filters 1.25.0-150200.3.25.1 SUSE-SU-2025:4158-1
SLES 12 SP5 cups-filters 1.0.58-19.35.1 SUSE-SU-2025:4198-1
ReleasePackageFixed inAdvisory
openSUSE Leap 15.6 cups-filters 1.25.0-150200.3.25.1 SUSE-SU-2025:4158-1

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 cups-filters +2 1.28.16-3.amzn2023.0.5 ALAS2023-2025-1291
Amazon Linux 2 cups-filters +2 1.0.35-26.amzn2.0.2 ALAS2-2025-3082

Advisories 10

References