CVE-2026-64612
Published: July 20th, 2026
A flaw was found in libcupsfilters and cups-filters. The PNG image reading function creates a libpng reader without installing an error recovery handler, causing the CUPS image filter process to abort when processing a malformed PNG file. An unauthenticated attacker could exploit this by submitting a specially crafted PNG print job, leading to denial of service of the in-flight print job.
HIGH
CVSS v3: 7.5
CVSS v3: 7.5
Status
| DocFilters Release | Package | State | Justification | Comment |
|---|---|---|---|---|
| 26.3 | libpng (1.6.40) | Not Affected | Code Not Present | The defect is in libcupsfilters’/cups-filters’ own PNG-reading caller code (_cfImageReadPNG / _cupsImageReadPNG in cupsfilters/image-png.c), not in libpng itself; libpng behaves correctly, but the CUPS filter never installs an error handler or setjmp recovery frame around png_create_read_struct(). Document Filters does not vendor, build, or link libcupsfilters or cups-filters (no external/ entry, no CMake reference, no CUPS print-filter integration anywhere in the codebase), so this caller-side defect is never exercised. Document Filters’ own libpng call sites (filters/isysgraphics/source/ISYSimage.cpp) correctly install a custom error callback and setjmp(png_jmpbuf(…)) recovery around png_create_read_struct, so even the underlying unsafe pattern is not repeated here. |
| 26.2 | libpng (1.6.40) | Not Affected | Code Not Present | The defect is in libcupsfilters’/cups-filters’ own PNG-reading caller code (_cfImageReadPNG / _cupsImageReadPNG in cupsfilters/image-png.c), not in libpng itself; libpng behaves correctly, but the CUPS filter never installs an error handler or setjmp recovery frame around png_create_read_struct(). Document Filters does not vendor, build, or link libcupsfilters or cups-filters (no external/ entry, no CMake reference, no CUPS print-filter integration anywhere in the codebase), so this caller-side defect is never exercised. Document Filters’ own libpng call sites (filters/isysgraphics/source/ISYSimage.cpp) correctly install a custom error callback and setjmp(png_jmpbuf(…)) recovery around png_create_read_struct, so even the underlying unsafe pattern is not repeated here. |
| 26.1 | libpng (1.6.40) | Not Affected | Code Not Present | The defect is in libcupsfilters’/cups-filters’ own PNG-reading caller code (_cfImageReadPNG / _cupsImageReadPNG in cupsfilters/image-png.c), not in libpng itself; libpng behaves correctly, but the CUPS filter never installs an error handler or setjmp recovery frame around png_create_read_struct(). Document Filters does not vendor, build, or link libcupsfilters or cups-filters (no external/ entry, no CMake reference, no CUPS print-filter integration anywhere in the codebase), so this caller-side defect is never exercised. Document Filters’ own libpng call sites (filters/isysgraphics/source/ISYSimage.cpp) correctly install a custom error callback and setjmp(png_jmpbuf(…)) recovery around png_create_read_struct, so even the underlying unsafe pattern is not repeated here. |
| 25.4 | libpng (1.6.40) | Not Affected | Code Not Present | The defect is in libcupsfilters’/cups-filters’ own PNG-reading caller code (_cfImageReadPNG / _cupsImageReadPNG in cupsfilters/image-png.c), not in libpng itself; libpng behaves correctly, but the CUPS filter never installs an error handler or setjmp recovery frame around png_create_read_struct(). Document Filters does not vendor, build, or link libcupsfilters or cups-filters (no external/ entry, no CMake reference, no CUPS print-filter integration anywhere in the codebase), so this caller-side defect is never exercised. Document Filters’ own libpng call sites (filters/isysgraphics/source/ISYSimage.cpp) correctly install a custom error callback and setjmp(png_jmpbuf(…)) recovery around png_create_read_struct, so even the underlying unsafe pattern is not repeated here. |
| 25.3 | libpng (1.6.40) | Not Affected | Code Not Present | The defect is in libcupsfilters’/cups-filters’ own PNG-reading caller code (_cfImageReadPNG / _cupsImageReadPNG in cupsfilters/image-png.c), not in libpng itself; libpng behaves correctly, but the CUPS filter never installs an error handler or setjmp recovery frame around png_create_read_struct(). Document Filters does not vendor, build, or link libcupsfilters or cups-filters (no external/ entry, no CMake reference, no CUPS print-filter integration anywhere in the codebase), so this caller-side defect is never exercised. Document Filters’ own libpng call sites (filters/isysgraphics/source/ISYSimage.cpp) correctly install a custom error callback and setjmp(png_jmpbuf(…)) recovery around png_create_read_struct, so even the underlying unsafe pattern is not repeated here. |
| 25.2 | libpng (1.6.40) | Not Affected | Code Not Present | The defect is in libcupsfilters’/cups-filters’ own PNG-reading caller code (_cfImageReadPNG / _cupsImageReadPNG in cupsfilters/image-png.c), not in libpng itself; libpng behaves correctly, but the CUPS filter never installs an error handler or setjmp recovery frame around png_create_read_struct(). Document Filters does not vendor, build, or link libcupsfilters or cups-filters (no external/ entry, no CMake reference, no CUPS print-filter integration anywhere in the codebase), so this caller-side defect is never exercised. Document Filters’ own libpng call sites (filters/isysgraphics/source/ISYSimage.cpp) correctly install a custom error callback and setjmp(png_jmpbuf(…)) recovery around png_create_read_struct, so even the underlying unsafe pattern is not repeated here. |
| 25.1 | libpng (1.6.40) | Not Affected | Code Not Present | The defect is in libcupsfilters’/cups-filters’ own PNG-reading caller code (_cfImageReadPNG / _cupsImageReadPNG in cupsfilters/image-png.c), not in libpng itself; libpng behaves correctly, but the CUPS filter never installs an error handler or setjmp recovery frame around png_create_read_struct(). Document Filters does not vendor, build, or link libcupsfilters or cups-filters (no external/ entry, no CMake reference, no CUPS print-filter integration anywhere in the codebase), so this caller-side defect is never exercised. Document Filters’ own libpng call sites (filters/isysgraphics/source/ISYSimage.cpp) correctly install a custom error callback and setjmp(png_jmpbuf(…)) recovery around png_create_read_struct, so even the underlying unsafe pattern is not repeated here. |
| 24.4 | libpng (1.6.40) | Not Affected | Code Not Present | The defect is in libcupsfilters’/cups-filters’ own PNG-reading caller code (_cfImageReadPNG / _cupsImageReadPNG in cupsfilters/image-png.c), not in libpng itself; libpng behaves correctly, but the CUPS filter never installs an error handler or setjmp recovery frame around png_create_read_struct(). Document Filters does not vendor, build, or link libcupsfilters or cups-filters (no external/ entry, no CMake reference, no CUPS print-filter integration anywhere in the codebase), so this caller-side defect is never exercised. Document Filters’ own libpng call sites (filters/isysgraphics/source/ISYSimage.cpp) correctly install a custom error callback and setjmp(png_jmpbuf(…)) recovery around png_create_read_struct, so even the underlying unsafe pattern is not repeated here. |
| 24.4.0 | libpng (1.6.40) | Not Affected | Code Not Present | The defect is in libcupsfilters’/cups-filters’ own PNG-reading caller code (_cfImageReadPNG / _cupsImageReadPNG in cupsfilters/image-png.c), not in libpng itself; libpng behaves correctly, but the CUPS filter never installs an error handler or setjmp recovery frame around png_create_read_struct(). Document Filters does not vendor, build, or link libcupsfilters or cups-filters (no external/ entry, no CMake reference, no CUPS print-filter integration anywhere in the codebase), so this caller-side defect is never exercised. Document Filters’ own libpng call sites (filters/isysgraphics/source/ISYSimage.cpp) correctly install a custom error callback and setjmp(png_jmpbuf(…)) recovery around png_create_read_struct, so even the underlying unsafe pattern is not repeated here. |
| 24.3 | libpng (1.6.40) | Not Affected | Code Not Present | The defect is in libcupsfilters’/cups-filters’ own PNG-reading caller code (_cfImageReadPNG / _cupsImageReadPNG in cupsfilters/image-png.c), not in libpng itself; libpng behaves correctly, but the CUPS filter never installs an error handler or setjmp recovery frame around png_create_read_struct(). Document Filters does not vendor, build, or link libcupsfilters or cups-filters (no external/ entry, no CMake reference, no CUPS print-filter integration anywhere in the codebase), so this caller-side defect is never exercised. Document Filters’ own libpng call sites (filters/isysgraphics/source/ISYSimage.cpp) correctly install a custom error callback and setjmp(png_jmpbuf(…)) recovery around png_create_read_struct, so even the underlying unsafe pattern is not repeated here. |
| 24.2 | libpng (1.6.40) | Not Affected | Code Not Present | The defect is in libcupsfilters’/cups-filters’ own PNG-reading caller code (_cfImageReadPNG / _cupsImageReadPNG in cupsfilters/image-png.c), not in libpng itself; libpng behaves correctly, but the CUPS filter never installs an error handler or setjmp recovery frame around png_create_read_struct(). Document Filters does not vendor, build, or link libcupsfilters or cups-filters (no external/ entry, no CMake reference, no CUPS print-filter integration anywhere in the codebase), so this caller-side defect is never exercised. Document Filters’ own libpng call sites (filters/isysgraphics/source/ISYSimage.cpp) correctly install a custom error callback and setjmp(png_jmpbuf(…)) recovery around png_create_read_struct, so even the underlying unsafe pattern is not repeated here. |
| 24.1 | libpng (1.6.40) | Not Affected | Code Not Present | The defect is in libcupsfilters’/cups-filters’ own PNG-reading caller code (_cfImageReadPNG / _cupsImageReadPNG in cupsfilters/image-png.c), not in libpng itself; libpng behaves correctly, but the CUPS filter never installs an error handler or setjmp recovery frame around png_create_read_struct(). Document Filters does not vendor, build, or link libcupsfilters or cups-filters (no external/ entry, no CMake reference, no CUPS print-filter integration anywhere in the codebase), so this caller-side defect is never exercised. Document Filters’ own libpng call sites (filters/isysgraphics/source/ISYSimage.cpp) correctly install a custom error callback and setjmp(png_jmpbuf(…)) recovery around png_create_read_struct, so even the underlying unsafe pattern is not repeated here. |
| 23.3 | libpng (1.6.40) | Not Affected | Code Not Present | The defect is in libcupsfilters’/cups-filters’ own PNG-reading caller code (_cfImageReadPNG / _cupsImageReadPNG in cupsfilters/image-png.c), not in libpng itself; libpng behaves correctly, but the CUPS filter never installs an error handler or setjmp recovery frame around png_create_read_struct(). Document Filters does not vendor, build, or link libcupsfilters or cups-filters (no external/ entry, no CMake reference, no CUPS print-filter integration anywhere in the codebase), so this caller-side defect is never exercised. Document Filters’ own libpng call sites (filters/isysgraphics/source/ISYSimage.cpp) correctly install a custom error callback and setjmp(png_jmpbuf(…)) recovery around png_create_read_struct, so even the underlying unsafe pattern is not repeated here. |
| 23.2 | libpng (1.6.37) | Not Affected | Code Not Present | The defect is in libcupsfilters’/cups-filters’ own PNG-reading caller code (_cfImageReadPNG / _cupsImageReadPNG in cupsfilters/image-png.c), not in libpng itself; libpng behaves correctly, but the CUPS filter never installs an error handler or setjmp recovery frame around png_create_read_struct(). Document Filters does not vendor, build, or link libcupsfilters or cups-filters (no external/ entry, no CMake reference, no CUPS print-filter integration anywhere in the codebase), so this caller-side defect is never exercised. Document Filters’ own libpng call sites (filters/isysgraphics/source/ISYSimage.cpp) correctly install a custom error callback and setjmp(png_jmpbuf(…)) recovery around png_create_read_struct, so even the underlying unsafe pattern is not repeated here. |
| 23.1 | libpng (1.6.37) | Not Affected | Code Not Present | The defect is in libcupsfilters’/cups-filters’ own PNG-reading caller code (_cfImageReadPNG / _cupsImageReadPNG in cupsfilters/image-png.c), not in libpng itself; libpng behaves correctly, but the CUPS filter never installs an error handler or setjmp recovery frame around png_create_read_struct(). Document Filters does not vendor, build, or link libcupsfilters or cups-filters (no external/ entry, no CMake reference, no CUPS print-filter integration anywhere in the codebase), so this caller-side defect is never exercised. Document Filters’ own libpng call sites (filters/isysgraphics/source/ISYSimage.cpp) correctly install a custom error callback and setjmp(png_jmpbuf(…)) recovery around png_create_read_struct, so even the underlying unsafe pattern is not repeated here. |
| 22.4 | libpng (1.6.37) | Not Affected | Code Not Present | The defect is in libcupsfilters’/cups-filters’ own PNG-reading caller code (_cfImageReadPNG / _cupsImageReadPNG in cupsfilters/image-png.c), not in libpng itself; libpng behaves correctly, but the CUPS filter never installs an error handler or setjmp recovery frame around png_create_read_struct(). Document Filters does not vendor, build, or link libcupsfilters or cups-filters (no external/ entry, no CMake reference, no CUPS print-filter integration anywhere in the codebase), so this caller-side defect is never exercised. Document Filters’ own libpng call sites (filters/isysgraphics/source/ISYSimage.cpp) correctly install a custom error callback and setjmp(png_jmpbuf(…)) recovery around png_create_read_struct, so even the underlying unsafe pattern is not repeated here. |
| 22.3 | libpng (1.6.37) | Not Affected | Code Not Present | The defect is in libcupsfilters’/cups-filters’ own PNG-reading caller code (_cfImageReadPNG / _cupsImageReadPNG in cupsfilters/image-png.c), not in libpng itself; libpng behaves correctly, but the CUPS filter never installs an error handler or setjmp recovery frame around png_create_read_struct(). Document Filters does not vendor, build, or link libcupsfilters or cups-filters (no external/ entry, no CMake reference, no CUPS print-filter integration anywhere in the codebase), so this caller-side defect is never exercised. Document Filters’ own libpng call sites (filters/isysgraphics/source/ISYSimage.cpp) correctly install a custom error callback and setjmp(png_jmpbuf(…)) recovery around png_create_read_struct, so even the underlying unsafe pattern is not repeated here. |
| 22.2 | libpng (1.6.37) | Not Affected | Code Not Present | The defect is in libcupsfilters’/cups-filters’ own PNG-reading caller code (_cfImageReadPNG / _cupsImageReadPNG in cupsfilters/image-png.c), not in libpng itself; libpng behaves correctly, but the CUPS filter never installs an error handler or setjmp recovery frame around png_create_read_struct(). Document Filters does not vendor, build, or link libcupsfilters or cups-filters (no external/ entry, no CMake reference, no CUPS print-filter integration anywhere in the codebase), so this caller-side defect is never exercised. Document Filters’ own libpng call sites (filters/isysgraphics/source/ISYSimage.cpp) correctly install a custom error callback and setjmp(png_jmpbuf(…)) recovery around png_create_read_struct, so even the underlying unsafe pattern is not repeated here. |
| 22.1 | libpng (1.6.37) | Not Affected | Code Not Present | The defect is in libcupsfilters’/cups-filters’ own PNG-reading caller code (_cfImageReadPNG / _cupsImageReadPNG in cupsfilters/image-png.c), not in libpng itself; libpng behaves correctly, but the CUPS filter never installs an error handler or setjmp recovery frame around png_create_read_struct(). Document Filters does not vendor, build, or link libcupsfilters or cups-filters (no external/ entry, no CMake reference, no CUPS print-filter integration anywhere in the codebase), so this caller-side defect is never exercised. Document Filters’ own libpng call sites (filters/isysgraphics/source/ISYSimage.cpp) correctly install a custom error callback and setjmp(png_jmpbuf(…)) recovery around png_create_read_struct, so even the underlying unsafe pattern is not repeated here. |
| 21.11 | libpng (1.6.37) | Not Affected | Code Not Present | The defect is in libcupsfilters’/cups-filters’ own PNG-reading caller code (_cfImageReadPNG / _cupsImageReadPNG in cupsfilters/image-png.c), not in libpng itself; libpng behaves correctly, but the CUPS filter never installs an error handler or setjmp recovery frame around png_create_read_struct(). Document Filters does not vendor, build, or link libcupsfilters or cups-filters (no external/ entry, no CMake reference, no CUPS print-filter integration anywhere in the codebase), so this caller-side defect is never exercised. Document Filters’ own libpng call sites (filters/isysgraphics/source/ISYSimage.cpp) correctly install a custom error callback and setjmp(png_jmpbuf(…)) recovery around png_create_read_struct, so even the underlying unsafe pattern is not repeated here. |
| 21.8 | libpng (1.6.37) | Not Affected | Code Not Present | The defect is in libcupsfilters’/cups-filters’ own PNG-reading caller code (_cfImageReadPNG / _cupsImageReadPNG in cupsfilters/image-png.c), not in libpng itself; libpng behaves correctly, but the CUPS filter never installs an error handler or setjmp recovery frame around png_create_read_struct(). Document Filters does not vendor, build, or link libcupsfilters or cups-filters (no external/ entry, no CMake reference, no CUPS print-filter integration anywhere in the codebase), so this caller-side defect is never exercised. Document Filters’ own libpng call sites (filters/isysgraphics/source/ISYSimage.cpp) correctly install a custom error callback and setjmp(png_jmpbuf(…)) recovery around png_create_read_struct, so even the underlying unsafe pattern is not repeated here. |
| 21.5.0 | libpng (1.6.37) | Not Affected | Code Not Present | The defect is in libcupsfilters’/cups-filters’ own PNG-reading caller code (_cfImageReadPNG / _cupsImageReadPNG in cupsfilters/image-png.c), not in libpng itself; libpng behaves correctly, but the CUPS filter never installs an error handler or setjmp recovery frame around png_create_read_struct(). Document Filters does not vendor, build, or link libcupsfilters or cups-filters (no external/ entry, no CMake reference, no CUPS print-filter integration anywhere in the codebase), so this caller-side defect is never exercised. Document Filters’ own libpng call sites (filters/isysgraphics/source/ISYSimage.cpp) correctly install a custom error callback and setjmp(png_jmpbuf(…)) recovery around png_create_read_struct, so even the underlying unsafe pattern is not repeated here. |
| 21.2.0 | libpng (1.6.37) | Not Affected | Code Not Present | The defect is in libcupsfilters’/cups-filters’ own PNG-reading caller code (_cfImageReadPNG / _cupsImageReadPNG in cupsfilters/image-png.c), not in libpng itself; libpng behaves correctly, but the CUPS filter never installs an error handler or setjmp recovery frame around png_create_read_struct(). Document Filters does not vendor, build, or link libcupsfilters or cups-filters (no external/ entry, no CMake reference, no CUPS print-filter integration anywhere in the codebase), so this caller-side defect is never exercised. Document Filters’ own libpng call sites (filters/isysgraphics/source/ISYSimage.cpp) correctly install a custom error callback and setjmp(png_jmpbuf(…)) recovery around png_create_read_struct, so even the underlying unsafe pattern is not repeated here. |
| 11.4.19.3667 | libpng (1.6.37) | Not Affected | Code Not Present | The defect is in libcupsfilters’/cups-filters’ own PNG-reading caller code (_cfImageReadPNG / _cupsImageReadPNG in cupsfilters/image-png.c), not in libpng itself; libpng behaves correctly, but the CUPS filter never installs an error handler or setjmp recovery frame around png_create_read_struct(). Document Filters does not vendor, build, or link libcupsfilters or cups-filters (no external/ entry, no CMake reference, no CUPS print-filter integration anywhere in the codebase), so this caller-side defect is never exercised. Document Filters’ own libpng call sites (filters/isysgraphics/source/ISYSimage.cpp) correctly install a custom error callback and setjmp(png_jmpbuf(…)) recovery around png_create_read_struct, so even the underlying unsafe pattern is not repeated here. |
| 11.4.18.3599 | libpng (1.6.37) | Not Affected | Code Not Present | The defect is in libcupsfilters’/cups-filters’ own PNG-reading caller code (_cfImageReadPNG / _cupsImageReadPNG in cupsfilters/image-png.c), not in libpng itself; libpng behaves correctly, but the CUPS filter never installs an error handler or setjmp recovery frame around png_create_read_struct(). Document Filters does not vendor, build, or link libcupsfilters or cups-filters (no external/ entry, no CMake reference, no CUPS print-filter integration anywhere in the codebase), so this caller-side defect is never exercised. Document Filters’ own libpng call sites (filters/isysgraphics/source/ISYSimage.cpp) correctly install a custom error callback and setjmp(png_jmpbuf(…)) recovery around png_create_read_struct, so even the underlying unsafe pattern is not repeated here. |
| 11.4.16.3445 | libpng (1.6.28) | Not Affected | Code Not Present | The defect is in libcupsfilters’/cups-filters’ own PNG-reading caller code (_cfImageReadPNG / _cupsImageReadPNG in cupsfilters/image-png.c), not in libpng itself; libpng behaves correctly, but the CUPS filter never installs an error handler or setjmp recovery frame around png_create_read_struct(). Document Filters does not vendor, build, or link libcupsfilters or cups-filters (no external/ entry, no CMake reference, no CUPS print-filter integration anywhere in the codebase), so this caller-side defect is never exercised. Document Filters’ own libpng call sites (filters/isysgraphics/source/ISYSimage.cpp) correctly install a custom error callback and setjmp(png_jmpbuf(…)) recovery around png_create_read_struct, so even the underlying unsafe pattern is not repeated here. |
| 11.4.15.3368 | libpng (1.6.28) | Not Affected | Code Not Present | The defect is in libcupsfilters’/cups-filters’ own PNG-reading caller code (_cfImageReadPNG / _cupsImageReadPNG in cupsfilters/image-png.c), not in libpng itself; libpng behaves correctly, but the CUPS filter never installs an error handler or setjmp recovery frame around png_create_read_struct(). Document Filters does not vendor, build, or link libcupsfilters or cups-filters (no external/ entry, no CMake reference, no CUPS print-filter integration anywhere in the codebase), so this caller-side defect is never exercised. Document Filters’ own libpng call sites (filters/isysgraphics/source/ISYSimage.cpp) correctly install a custom error callback and setjmp(png_jmpbuf(…)) recovery around png_create_read_struct, so even the underlying unsafe pattern is not repeated here. |
| 11.4.14.3263 | libpng (1.6.28) | Not Affected | Code Not Present | The defect is in libcupsfilters’/cups-filters’ own PNG-reading caller code (_cfImageReadPNG / _cupsImageReadPNG in cupsfilters/image-png.c), not in libpng itself; libpng behaves correctly, but the CUPS filter never installs an error handler or setjmp recovery frame around png_create_read_struct(). Document Filters does not vendor, build, or link libcupsfilters or cups-filters (no external/ entry, no CMake reference, no CUPS print-filter integration anywhere in the codebase), so this caller-side defect is never exercised. Document Filters’ own libpng call sites (filters/isysgraphics/source/ISYSimage.cpp) correctly install a custom error callback and setjmp(png_jmpbuf(…)) recovery around png_create_read_struct, so even the underlying unsafe pattern is not repeated here. |
| 11.4.13.3179 | libpng (1.6.28) | Not Affected | Code Not Present | The defect is in libcupsfilters’/cups-filters’ own PNG-reading caller code (_cfImageReadPNG / _cupsImageReadPNG in cupsfilters/image-png.c), not in libpng itself; libpng behaves correctly, but the CUPS filter never installs an error handler or setjmp recovery frame around png_create_read_struct(). Document Filters does not vendor, build, or link libcupsfilters or cups-filters (no external/ entry, no CMake reference, no CUPS print-filter integration anywhere in the codebase), so this caller-side defect is never exercised. Document Filters’ own libpng call sites (filters/isysgraphics/source/ISYSimage.cpp) correctly install a custom error callback and setjmp(png_jmpbuf(…)) recovery around png_create_read_struct, so even the underlying unsafe pattern is not repeated here. |
| 11.4.12.3054 | libpng (1.6.28) | Not Affected | Code Not Present | The defect is in libcupsfilters’/cups-filters’ own PNG-reading caller code (_cfImageReadPNG / _cupsImageReadPNG in cupsfilters/image-png.c), not in libpng itself; libpng behaves correctly, but the CUPS filter never installs an error handler or setjmp recovery frame around png_create_read_struct(). Document Filters does not vendor, build, or link libcupsfilters or cups-filters (no external/ entry, no CMake reference, no CUPS print-filter integration anywhere in the codebase), so this caller-side defect is never exercised. Document Filters’ own libpng call sites (filters/isysgraphics/source/ISYSimage.cpp) correctly install a custom error callback and setjmp(png_jmpbuf(…)) recovery around png_create_read_struct, so even the underlying unsafe pattern is not repeated here. |
| 11.4.11.3040 | libpng (1.6.28) | Not Affected | Code Not Present | The defect is in libcupsfilters’/cups-filters’ own PNG-reading caller code (_cfImageReadPNG / _cupsImageReadPNG in cupsfilters/image-png.c), not in libpng itself; libpng behaves correctly, but the CUPS filter never installs an error handler or setjmp recovery frame around png_create_read_struct(). Document Filters does not vendor, build, or link libcupsfilters or cups-filters (no external/ entry, no CMake reference, no CUPS print-filter integration anywhere in the codebase), so this caller-side defect is never exercised. Document Filters’ own libpng call sites (filters/isysgraphics/source/ISYSimage.cpp) correctly install a custom error callback and setjmp(png_jmpbuf(…)) recovery around png_create_read_struct, so even the underlying unsafe pattern is not repeated here. |
| 11.4.11.2990 | libpng (1.6.28) | Not Affected | Code Not Present | The defect is in libcupsfilters’/cups-filters’ own PNG-reading caller code (_cfImageReadPNG / _cupsImageReadPNG in cupsfilters/image-png.c), not in libpng itself; libpng behaves correctly, but the CUPS filter never installs an error handler or setjmp recovery frame around png_create_read_struct(). Document Filters does not vendor, build, or link libcupsfilters or cups-filters (no external/ entry, no CMake reference, no CUPS print-filter integration anywhere in the codebase), so this caller-side defect is never exercised. Document Filters’ own libpng call sites (filters/isysgraphics/source/ISYSimage.cpp) correctly install a custom error callback and setjmp(png_jmpbuf(…)) recovery around png_create_read_struct, so even the underlying unsafe pattern is not repeated here. |
| 11.4.10.2934 | libpng (1.6.28) | Not Affected | Code Not Present | The defect is in libcupsfilters’/cups-filters’ own PNG-reading caller code (_cfImageReadPNG / _cupsImageReadPNG in cupsfilters/image-png.c), not in libpng itself; libpng behaves correctly, but the CUPS filter never installs an error handler or setjmp recovery frame around png_create_read_struct(). Document Filters does not vendor, build, or link libcupsfilters or cups-filters (no external/ entry, no CMake reference, no CUPS print-filter integration anywhere in the codebase), so this caller-side defect is never exercised. Document Filters’ own libpng call sites (filters/isysgraphics/source/ISYSimage.cpp) correctly install a custom error callback and setjmp(png_jmpbuf(…)) recovery around png_create_read_struct, so even the underlying unsafe pattern is not repeated here. |
| 11.4.9.2878 | libpng (1.6.28) | Not Affected | Code Not Present | The defect is in libcupsfilters’/cups-filters’ own PNG-reading caller code (_cfImageReadPNG / _cupsImageReadPNG in cupsfilters/image-png.c), not in libpng itself; libpng behaves correctly, but the CUPS filter never installs an error handler or setjmp recovery frame around png_create_read_struct(). Document Filters does not vendor, build, or link libcupsfilters or cups-filters (no external/ entry, no CMake reference, no CUPS print-filter integration anywhere in the codebase), so this caller-side defect is never exercised. Document Filters’ own libpng call sites (filters/isysgraphics/source/ISYSimage.cpp) correctly install a custom error callback and setjmp(png_jmpbuf(…)) recovery around png_create_read_struct, so even the underlying unsafe pattern is not repeated here. |
| 11.4.8.2822 | libpng (1.6.28) | Not Affected | Code Not Present | The defect is in libcupsfilters’/cups-filters’ own PNG-reading caller code (_cfImageReadPNG / _cupsImageReadPNG in cupsfilters/image-png.c), not in libpng itself; libpng behaves correctly, but the CUPS filter never installs an error handler or setjmp recovery frame around png_create_read_struct(). Document Filters does not vendor, build, or link libcupsfilters or cups-filters (no external/ entry, no CMake reference, no CUPS print-filter integration anywhere in the codebase), so this caller-side defect is never exercised. Document Filters’ own libpng call sites (filters/isysgraphics/source/ISYSimage.cpp) correctly install a custom error callback and setjmp(png_jmpbuf(…)) recovery around png_create_read_struct, so even the underlying unsafe pattern is not repeated here. |
Severity score breakdown
Attack Complexity
LOW
Attack Vector
NETWORK
Availability Impact
HIGH
Base Score
7.5
Base Severity
HIGH
Confidentiality Impact
NONE
Integrity Impact
NONE
Privileges Required
NONE
Scope
UNCHANGED
User Interaction
NONE
Vector String
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Version
3.1