Executive brief
A vulnerability exists in the software responsible for processing print jobs on Linux systems. By sending a specially crafted PNG image to a printer, an unauthorized user can cause the printing service to crash. This results in a denial of service, preventing the current print job from completing and potentially disrupting printing operations.
Technical details
A flaw exists in the _cfImageReadPNG() and _cupsImageReadPNG() functions within cupsfilters/image-png.c. The software initializes a libpng reader using png_create_read_struct without implementing a custom error handler or a setjmp recovery frame. Consequently, when libpng encounters a malformed PNG file, it triggers the default error handler which calls abort(), leading to a SIGABRT and terminating the filter process. This allows a remote, unauthenticated attacker to cause a denial of service (DoS) for in-flight print jobs. As of the advisory date, no upstream fix is available.
Affected products
- OpenPrinting cups-filters through 1.28.17
- OpenPrinting libcupsfilters through 2.1.1
- Red Hat Red Hat Enterprise Linux 8
- Red Hat Red Hat Enterprise Linux 9
- Red Hat Red Hat Enterprise Linux 10
Timeline
- 2026-07-20: disclosed
- 2026-07-20: advisory