Is CVE-2026-64611 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-64611 being exploited in the wild.

How severe is CVE-2026-64611?

High severity, with a CVSS score of 7.5, published 23 July 2026.

Which products and versions are affected?

OpenPrinting Libcupsfilters through 2.1.1.

Is there a fix for CVE-2026-64611?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-64611 attacked?

It is attacked over the network or from the adjacent network, in a software library.

Am I affected by CVE-2026-64611?

Check whether you run OpenPrinting Cups-Filters, OpenPrinting Libcupsfilters, Red Hat Enterprise Linux 10 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-64611: OpenPrinting libcupsfilters infinite loop in cfIEEE1284NormalizeMakeModel

CVE-2026-64611 · Severity: high · CVSS 7.5 · Published 2026-07-23

A flaw in the libcupsfilters library, which is used by Linux systems to manage printing tasks, can allow an attacker to disable printing services. By broadcasting a malicious printer advertisement on a local network, an attacker can cause the system's processor to become stuck in an infinite loop. This results in a denial-of-service condition where the printing service becomes unresponsive and system performance is significantly degraded.

Technologies: OpenPrinting Cups-Filters, OpenPrinting Libcupsfilters, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9. Vendors: OpenPrinting, Red Hat.

Quick answers

Is CVE-2026-64611 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-64611 being exploited in the wild.
How severe is CVE-2026-64611?: High severity, with a CVSS score of 7.5, published 23 July 2026.
Which products and versions are affected?: OpenPrinting Libcupsfilters through 2.1.1.
Is there a fix for CVE-2026-64611?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-64611 attacked?: It is attacked over the network or from the adjacent network, in a software library.
Am I affected by CVE-2026-64611?: Check whether you run OpenPrinting Cups-Filters, OpenPrinting Libcupsfilters, Red Hat Enterprise Linux 10 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability exists in the cfIEEE1284NormalizeMakeModel() function within cupsfilters/ieee1284.c of libcupsfilters through version 2.1.1. When the function processes an IEEE-1284 device ID containing an empty model (MDL) field, a logic error in the deduplication loop causes it to enter an infinite loop. Specifically, the loop fails to make progress when modelptr equals the buffer, leading to sustained 100% CPU utilization on the affected core. This is reachable over the network via cups-browsed when it processes printer-advertised device IDs via IPP or DNS-SD. At the time of reporting, no upstream fix was available.

Affected products

OpenPrinting libcupsfilters through 2.1.1
OpenPrinting cups-filters
Red Hat Red Hat Enterprise Linux 7
Red Hat Red Hat Enterprise Linux 8
Red Hat Red Hat Enterprise Linux 9
Red Hat Red Hat Enterprise Linux 10

Timeline

2026-07-20: other: Reported to Red Hat Bugzilla
2026-07-23: advisory: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.