Moderate Vulnerability in CUPS: Null Pointer Dereference Leading to Remote DoS
Summary
ALSA-2025:22063: Moderate: cups security update. Affects cups versions < 1:2.2.6-64.el8_10. Fixed in 1:2.2.6-64.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Common UNIX Printing System (CUPS) is a widely used printing system for UNIX-like operating systems, including Linux. It provides a portable printing layer that allows users to manage print jobs and queues. CUPS is essential for enabling printing capabilities across various applications and devices. However, it has been identified that certain versions of CUPS are vulnerable to a null pointer dereference issue, which can lead to a denial of service (DoS) when exploited remotely.
Vulnerability Detail
The vulnerability identified as CVE-2025-58364 is a null pointer dereference in the CUPS function ipp_read_io(). This flaw can be exploited by an attacker to cause the CUPS service to crash, resulting in a denial of service. The impact of this vulnerability is significant as it can disrupt printing services for users and applications relying on CUPS, potentially affecting productivity and operations in environments where printing is critical.
How To Fix
Minimum fixed version
1:2.2.6-64.el8_10
This is the first release that contains the fix.
sudo dnf update cupsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users may consider disabling the CUPS service until the patch is applied. This can be done by running the command:
sudo systemctl stop cups
However, this will prevent any printing operations from being processed.
Conclusion
The identified vulnerability in CUPS poses a moderate risk due to its potential to cause denial of service. It is crucial for users to update their CUPS packages to the latest patched versions to mitigate this risk. Additionally, utilizing tools like Vulert can help monitor and alert for open-source vulnerabilities in your software.
See every vulnerability recorded for cups →
FAQ
CUPS stands for Common UNIX Printing System, which is a printing system for UNIX-like operating systems that allows users to manage print jobs and queues.
CVE-2025-58364 is a null pointer dereference vulnerability in CUPS that can lead to a remote denial of service (DoS) when exploited.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploiting this vulnerability can cause the CUPS service to crash, leading to disruptions in printing services and affecting productivity.
It is advisable to regularly check for updates and apply them promptly to ensure that your system is protected against known vulnerabilities.
Related vulnerabilities
Recent vulnerabilities recorded for cups.
