CVE-2025-64524
Publication date 20 November 2025
Last updated 26 November 2025
Ubuntu priority
Description
cups-filters contains backends, filters, and other software required to get the cups printing service working on operating systems other than macos. In versions 2.0.1 and prior, a heap-buffer-overflow vulnerability in the rastertopclx filter causes the program to crash with a segmentation fault when processing maliciously crafted input data. This issue can be exploited to trigger memory corruption, potentially leading to arbitrary code execution. This issue has been patched via commit 956283c.
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| cups-filters | 25.10 questing |
Fixed 2.0.1-0ubuntu3.25.10.1
|
| 25.04 plucky |
Fixed 2.0.1-0ubuntu3.25.04.1
|
|
| 24.04 LTS noble |
Fixed 2.0.0-0ubuntu4.1
|
|
| 22.04 LTS jammy |
Fixed 1.28.15-0ubuntu1.5
|
|
| 20.04 LTS focal |
Fixed 1.27.4-1ubuntu0.4+esm1
|
|
| 18.04 LTS bionic |
Fixed 1.20.2-0ubuntu3.3+esm2
|
|
| 16.04 LTS xenial |
Fixed 1.8.3-2ubuntu3.5+esm3
|
|
| libcupsfilters | 25.10 questing |
Not affected
|
| 25.04 plucky |
Not affected
|
|
| 24.04 LTS noble |
Not affected
|
|
| 22.04 LTS jammy | Not in release |
Get expanded security coverage with Ubuntu Pro
Reduce your average CVE exposure time from 98 days to 1 day with expanded CVE patching, ten-years security maintenance and optional support for the full stack of open-source applications. Free for personal use.
Get Ubuntu Pro 30-day free trialSeverity score breakdown
| Parameter | Value |
|---|---|
| Base score |
3.3 · Low
|
| Attack vector | Local |
| Attack complexity | Low |
| Privileges required | Low |
| User interaction | None |
| Scope | Unchanged |
| Confidentiality | None |
| Integrity impact | None |
| Availability impact | Low |
| Vector | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L |
References
Related Ubuntu Security Notices (USN)
- USN-7878-1
- cups-filters vulnerabilities
- 20 November 2025
- USN-7878-2
- cups-filters vulnerabilities
- 24 November 2025