SUSE CUPS Filters Moderate Denial of Service Vulnern 2026-3935

Back Linuxsecurity

SUSE CUPS Filters Moderate Denial of Service Vulnern 2026-3935

Linuxsecurity •LinuxSecurity Advisories • September 3, 2026

Share: View original

Keep your Linux systems secure and up to date with practical patching guidance. Review Linux Patching Best Practices ×

## This update for cups-filters fixes the following issues: * CVE-2026-64611: user who controls an IEEE-1284 device ID consumed by `cfIEEE1284GetMakeModel` can drive `cfIEEE1284NormalizeMakeModel` into an infinite loop (bsc#1273145). * CVE-2026-64612: authenticated client that can submit an image print job can abort the CUPS filter process by supplying a malformed PNG (bsc#1273146). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * Basesystem Module 15-SP7 zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP7-2026-3935=1 ## Package List: * Basesystem Module 15-SP7 (aarch64 ppc64le s390x x86_64) * cups-filters-1.25.0-150200.3.31.1

## This update for cups-filters fixes the following issues: * CVE-2026-64611: user who controls an IEEE-1284 device ID consumed by `cfIEEE1284GetMakeModel` can drive `cfIEEE1284NormalizeMakeModel` into an infinite loop (bsc#1273145). * CVE-2026-64612: authenticated client that can submit an image print job can abort the CUPS filter process by supplying a malformed PNG (bsc#1273146). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * Basesystem Module 15-SP7 zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP7-2026-3935=1 ## Package List: * Basesystem Module 15-SP7 (aarch64 ppc64le s390x x86_64) * cups-filters-1.25.0-150200.3.31.1

* CVE-2026-64611 ( SUSE ): 7.1

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

* CVE-2026-64611 ( SUSE ): 6.5 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

* CVE-2026-64611 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

* CVE-2026-64612 ( SUSE ): 6.9

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

* CVE-2026-64612 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

* CVE-2026-64612 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

* Basesystem Module 15-SP7

* SUSE Linux Enterprise Desktop 15 SP7

* SUSE Linux Enterprise Real Time 15 SP7

* SUSE Linux Enterprise Server 15 SP7

Announcement ID: SUSE-SU-2026:3935-1 Release Date: 2026-09-03T07:24:47Z Rating: moderate

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Moderate Vulnerabilities in SUSE CUPS Filters Affecting Print Jobs SUSE has released updates addressing two vulnerabilities in cups-filters, identified as CVE-2026-64611 and CVE-2026-64612. CVE-2026-64611 allows an attacker controlling an IEEE-1284 device ID to cause an infinite loop in the system, while CVE-2026-64612 enables an authenticated client to abort the CUPS filter process by submitting a malformed PNG image. Both vulnerabilities are rated moderate in severity. The issues affect various SUSE Linux Enterprise Server versions, including 12 SP5 and 15 SP7. Administrators are advised to apply the patches using SUSE's recommended installation methods. The vulnerabilities were published on July 23 and July 20, 2026, respectively. Current status indicates that these vulnerabilities have been patched, and no active exploitation has been reported. 2 sources 46

Extracted Entities

Attack Types (1)

Denial of Service

Companies (1)

CVEs (2)

CVE-2026-64611 CVE-2026-64612

Platforms (2)

Linux SUSE Linux Enterprise Server