CVE-2026-64611 Details
Description
A flaw was found in libcupsfilters. The cfIEEE1284NormalizeMakeModel() function enters an infinite loop when processing a printer-advertised IEEE-1284 device ID with an empty model field, causing sustained CPU consumption. A network-adjacent attacker could exploit this by broadcasting a specially crafted printer advertisement, leading to denial of service.
A denial-of-service vulnerability has been identified in the libcupsfilters component, specifically in versions through 2.1.1. The issue arises in the cfIEEE1284NormalizeMakeModel() function, which can enter an infinite loop when processing an IEEE-1284 device ID that has an empty model field. This flaw leads to excessive CPU usage. The vulnerability can be exploited by a network-adjacent attacker who broadcasts a specially crafted printer advertisement, causing sustained CPU consumption on the affected system.
If automatic network printer discovery is not needed, the cups-browsed service can be stopped to eliminate the vulnerability. If cups-browsed must be used, it is advisable to restrict untrusted networks from sending data to the daemon.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-835 | Loop with Unreachable Exit Condition ('Infinite Loop') | [email protected] |
Affected Products
No affected product data is available for this CVE.
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 19, 2026 | CVE Modified | [email protected] |
| Aug 13, 2026 | CVE Modified | [email protected] |
| Aug 12, 2026 | CVE Modified | [email protected] |
| Jul 23, 2026 | CVE Modified | CISA-ADP |
| Jul 23, 2026 | New CVE Received | [email protected] |