SUSE cups-filters Moderate Infinite Loop and Print Job Issues 2026-3918

Back Linuxsecurity

SUSE cups-filters Moderate Infinite Loop and Print Job Issues 2026-3918

Linuxsecurity •LinuxSecurity Advisories • September 2, 2026

Share: View original

Find practical guidance for preventing, investigating, and responding to Linux security problems. Review Linux Privileges ×

## This update for cups-filters fixes the following issues: * CVE-2026-64611: user who controls an IEEE-1284 device ID consumed by `cfIEEE1284GetMakeModel` can drive `cfIEEE1284NormalizeMakeModel` into an infinite loop (bsc#1273145). * CVE-2026-64612: authenticated client that can submit an image print job can abort the CUPS filter process by supplying a malformed PNG (bsc#1273146). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * SUSE Linux Enterprise Server 12 SP5 LTSS Extended Security zypper in -t patch SUSE-SLE-SERVER-12-SP5-LTSS-EXTENDED-SECURITY-2026-3918=1 ## Package List:

## This update for cups-filters fixes the following issues: * CVE-2026-64611: user who controls an IEEE-1284 device ID consumed by `cfIEEE1284GetMakeModel` can drive `cfIEEE1284NormalizeMakeModel` into an infinite loop (bsc#1273145). * CVE-2026-64612: authenticated client that can submit an image print job can abort the CUPS filter process by supplying a malformed PNG (bsc#1273146). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * SUSE Linux Enterprise Server 12 SP5 LTSS Extended Security zypper in -t patch SUSE-SLE-SERVER-12-SP5-LTSS-EXTENDED-SECURITY-2026-3918=1 ## Package List:

* CVE-2026-64611 ( SUSE ): 7.1

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

* CVE-2026-64611 ( SUSE ): 6.5 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

* CVE-2026-64611 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

* CVE-2026-64612 ( SUSE ): 6.9

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

* CVE-2026-64612 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

* CVE-2026-64612 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

* SUSE Linux Enterprise Server 12 SP5

* SUSE Linux Enterprise Server 12 SP5 LTSS Extended Security

* SUSE Linux Enterprise Server for SAP Applications 12 SP5

Announcement ID: SUSE-SU-2026:3918-1 Release Date: 2026-09-01T14:58:38Z Rating: moderate

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Moderate Vulnerabilities in SUSE CUPS Filters Affecting Print Jobs SUSE has released updates addressing two vulnerabilities in cups-filters, identified as CVE-2026-64611 and CVE-2026-64612. CVE-2026-64611 allows an attacker controlling an IEEE-1284 device ID to cause an infinite loop in the system, while CVE-2026-64612 enables an authenticated client to abort the CUPS filter process by submitting a malformed PNG image. Both vulnerabilities are rated moderate in severity. The issues affect various SUSE Linux Enterprise Server versions, including 12 SP5 and 15 SP7. Administrators are advised to apply the patches using SUSE's recommended installation methods. The vulnerabilities were published on July 23 and July 20, 2026, respectively. Current status indicates that these vulnerabilities have been patched, and no active exploitation has been reported. 2 sources 46

Extracted Entities

CVEs (2)

CVE-2026-64611 CVE-2026-64612

Platforms (1)