CVE-2025-57812

Description

CUPS is a standards-based, open-source printing system, and `libcupsfilters` contains the code of the filters of the former `cups-filters` package as library functions to be used for the data format conversion tasks needed in Printer Applications. In CUPS-Filters versions up to and including 1.28.17 and libscupsfilters versions 2.0.0 through 2.1.1, CUPS-Filters's `imagetoraster` filter has an out of bounds read/write vulnerability in the processing of TIFF image files. While the pixel buffer is allocated with the number of pixels times a pre-calculated bytes-per-pixel value, the function which processes these pixels is called with a size of the number of pixels times 3. When suitable inputs are passed, the bytes-per-pixel value can be set to 1 and bytes outside of the buffer bounds get processed. In order to trigger the bug, an attacker must issue a print job with a crafted TIFF file, and pass appropriate print job options to control the bytes-per-pixel value of the output format. They must choose a printer configuration under which the `imagetoraster` filter or its C-function equivalent `cfFilterImageToRaster()` gets invoked. The vulnerability exists in both CUPS-Filters 1.x and the successor library libcupsfilters (CUPS-Filters 2.x). In CUPS-Filters 2.x, the vulnerable function is `_cfImageReadTIFF() in libcupsfilters`. When this function is invoked as part of `cfFilterImageToRaster()`, the caller passes a look-up-table during whose processing the out of bounds memory access happens. In CUPS-Filters 1.x, the equivalent functions are all found in the cups-filters repository, which is not split into subprojects yet, and the vulnerable code is in `_cupsImageReadTIFF()`, which is called through `cupsImageOpen()` from the `imagetoraster` tool. A patch is available in commit b69dfacec7f176281782e2f7ac44f04bf9633cfa.

Read the notes from the security team

Status

Show unmaintained releases

Package	Ubuntu Release	Status
cups-filters	25.10 questing	Not affected
	25.04 plucky	Not affected
	24.04 LTS noble	Not affected
	22.04 LTS jammy	Fixed 1.28.15-0ubuntu1.5
	20.04 LTS focal	Fixed 1.27.4-1ubuntu0.4+esm1
	18.04 LTS bionic	Fixed 1.20.2-0ubuntu3.3+esm2
	16.04 LTS xenial	Fixed 1.8.3-2ubuntu3.5+esm3
libcupsfilters	25.10 questing	Fixed 2.1.1-0ubuntu3.1
	25.04 plucky	Fixed 2.1.1-0ubuntu2.1
	24.04 LTS noble	Fixed 2.0.0-0ubuntu7.2
	22.04 LTS jammy	Not in release

Get expanded security coverage with Ubuntu Pro

Reduce your average CVE exposure time from 98 days to 1 day with expanded CVE patching, ten-years security maintenance and optional support for the full stack of open-source applications. Free for personal use.

Get Ubuntu Pro 30-day free trial

Notes

mdeslaur

code moved from cups-filters to libcupsfilters in 2.x

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package	Patch details
cups-filters	Upstream: 5122052 Upstream: cb92700 Upstream: 719c557 Upstream: 7bd588a Upstream: 5e5f1c5
libcupsfilters	Upstream: b69dfac

Severity score breakdown

Parameter	Value
Base score	3.7 · Low
Attack vector	Adjacent
Attack complexity	High
Privileges required	Low
User interaction	None
Scope	Unchanged
Confidentiality	Low
Integrity impact	Low
Availability impact	None
Vector	CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

CVE-2025-57812

Cvss 3 Severity Score