CVE-2025-64524
📋 TL;DR
A heap-buffer-overflow vulnerability in the rastertopclx filter of cups-filters allows memory corruption when processing malicious input. This can cause program crashes (segmentation faults) and potentially lead to arbitrary code execution. Systems using cups-filters version 2.0.1 or earlier on non-macOS platforms are affected.
💻 Affected Systems
- cups-filters
📦 What is this software?
Cups Filters by Openprinting
⚠️ Risk & Real-World Impact
Worst Case
Arbitrary code execution with the privileges of the cups-filters process, potentially leading to system compromise.
Likely Case
Denial of service through program crashes (segmentation faults) disrupting printing services.
If Mitigated
Limited impact if proper input validation and memory protections are in place, though crashes may still occur.
🎯 Exploit Status
Exploitation requires ability to submit malicious input to the rastertopclx filter, typically via print jobs. No public exploit code is known at this time.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version after commit 956283c (specific version number not provided in advisory)
Vendor Advisory: https://github.com/OpenPrinting/cups-filters/security/advisories/GHSA-rq44-2q5p-x3hv
Restart Required: Yes
Instructions:
1. Update cups-filters to version containing commit 956283c. 2. Restart CUPS service: 'systemctl restart cups' (Linux). 3. Verify the patch is applied using version check.
🔧 Temporary Workarounds
Disable rastertopclx filter
linuxTemporarily disable the vulnerable filter to prevent exploitation (will break some printing functionality).
sudo mv /usr/lib/cups/filter/rastertopclx /usr/lib/cups/filter/rastertopclx.disabled
sudo systemctl restart cups
🧯 If You Can't Patch
- Restrict print job submission to trusted users only.
- Monitor CUPS logs for segmentation faults or unusual activity.
🔍 How to Verify
Check if Vulnerable:
Check cups-filters version: 'cups-config --version' or 'rpm -q cups-filters' (RHEL) or 'dpkg -l cups-filters' (Debian). If version is 2.0.1 or earlier, system is vulnerable.Check Version:
cups-config --version 2>/dev/null || rpm -q cups-filters 2>/dev/null || dpkg -l cups-filters 2>/dev/null | grep ^iiVerify Fix Applied:
Verify version is updated beyond 2.0.1 and check for commit 956283c in source if building from source.📡 Detection & Monitoring
Log Indicators:
- Segmentation fault errors in CUPS logs (/var/log/cups/error_log)
- Unexpected crashes of rastertopclx process
Network Indicators:
- Unusual print job submissions from unexpected sources
SIEM Query:
source="cups_error_log" AND "segmentation fault" OR "rastertopclx crashed"🔗 References
- https://github.com/OpenPrinting/cups-filters/commit/956283c74a34ae924266a2a63f8e5f529a1abd06
- https://github.com/OpenPrinting/cups-filters/security/advisories/GHSA-rq44-2q5p-x3hv
- http://www.openwall.com/lists/oss-security/2025/11/20/1
- https://github.com/OpenPrinting/cups-filters/security/advisories/GHSA-rq44-2q5p-x3hv
