cups-filters, libcupsfilters — security advisory
CUPS is a standards-based, open-source printing system, and `libcupsfilters` contains the code of the filters of the former `cups-filters` package as library functions to be used for the data format conversion tasks needed in Printer Applications. In CUPS-Filters versions up to and including 1.28.17 and libscupsfilters versions 2.0.0 through 2.1.1, CUPS-Filters's `imagetoraster` filter has an out of bounds read/write vulnerability in the processing of TIFF image files. While the pixel buffer is allocated with the number of pixels times a pre-calculated bytes-per-pixel value, the function which processes these pixels is called with a size of the number of pixels times 3. When suitable inputs are passed, the bytes-per-pixel value can be set to 1 and bytes outside of the buffer bounds get processed. In order to trigger the bug, an attacker must issue a print job with a crafted TIFF file, and pass appropriate print job options to control the bytes-per-pixel value of the output format. They must choose a printer configuration under which the `imagetoraster` filter or its C-function equivalent `cfFilterImageToRaster()` gets invoked. The vulnerability exists in both CUPS-Filters 1.x and the successor library libcupsfilters (CUPS-Filters 2.x). In CUPS-Filters 2.x, the vulnerable function is `_cfImageReadTIFF() in libcupsfilters`. When this function is invoked as part of `cfFilterImageToRaster()`, the caller passes a look-up-table during whose processing the out of bounds memory acces
- Products
- cups-filters, libcupsfilters
- Affected versions
- 1.28.17-3, 1.28.17-3+deb12u1, 1.28.17-6, 2.0.0-3, 2.1.1-1
- Fixed versions
- 1.28.17-3+deb12u2, 1.28.17-6+deb13u1, 1.28.17-7, 2.0.0-3+deb13u1, 2.1.1-2
- CVEs
- CVE-2025-57812
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 22:55 UTC · Revision 1
Source evidence
CUPS is a standards-based, open-source printing system, and `libcupsfilters` contains the code of the filters of the former `cups-filters` package as library functions to be used for the data format conversion tasks needed in Printer Applications. In CUPS-Filters versions up to and including 1.28.17 and libscupsfilters versions 2.0.0 through 2.1.1, CUPS-Filters's `imagetoraster` filter has an out of bounds read/write vulnerability in the processing of TIFF image files. While the pixel buffer is allocated with the number of pixels times a pre-calculated bytes-per-pixel value, the function which processes these pixels is called with a size of the number of pixels times 3. When suitable inputs are passed, the bytes-per-pixel value can be set to 1 and bytes outside of the buffer bounds get processed. In order to trigger the bug, an attacker must issue a print job with a crafted TIFF file, and pass appropriate print job options to control the bytes-per-pixel value of the output format. They must choose a printer configuration under which the `imagetoraster` filter or its C-function equivalent `cfFilterImageToRaster()` gets invoked. The vulnerability exists in both CUPS-Filters 1.x and the successor library libcupsfilters (CUPS-Filters 2.x). In CUPS-Filters 2.x, the vulnerable function is `_cfImageReadTIFF() in libcupsfilters`. When this function is invoked as part of `cfFilterImageToRaster()`, the caller passes a look-up-table during whose processing the out of bounds memory acces
osv:DEBIAN-CVE-2025-57812
cups-filters
Fixed versions: 1.28.17-3+deb12u2
cups-filters
Fixed versions: 1.28.17-6+deb13u1
cups-filters
Fixed versions: 1.28.17-7
libcupsfilters
Fixed versions: 2.0.0-3+deb13u1
libcupsfilters
Fixed versions: 2.1.1-2
Complete source record
{
"id": "5797d26512515c36ff1126d06f4b38e768953586a27ac87287815bdc3f0a862c",
"url": "https://osv.dev/vulnerability/DEBIAN-CVE-2025-57812",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "DEBIAN-CVE-2025-57812",
"summary": "CUPS is a standards-based, open-source printing system, and `libcupsfilters` contains the code of the filters of the former `cups-filters` package as library functions to be used for the data format conversion tasks needed in Printer Applications. In CUPS-Filters versions up to and including 1.28.17 and libscupsfilters versions 2.0.0 through 2.1.1, CUPS-Filters's `imagetoraster` filter has an out of bounds read/write vulnerability in the processing of TIFF image files. While the pixel buffer is allocated with the number of pixels times a pre-calculated bytes-per-pixel value, the function which processes these pixels is called with a size of the number of pixels times 3. When suitable inputs are passed, the bytes-per-pixel value can be set to 1 and bytes outside of the buffer bounds get processed. In order to trigger the bug, an attacker must issue a print job with a crafted TIFF file, and pass appropriate print job options to control the bytes-per-pixel value of the output format. They must choose a printer configuration under which the `imagetoraster` filter or its C-function equivalent `cfFilterImageToRaster()` gets invoked. The vulnerability exists in both CUPS-Filters 1.x and the successor library libcupsfilters (CUPS-Filters 2.x). In CUPS-Filters 2.x, the vulnerable function is `_cfImageReadTIFF() in libcupsfilters`. When this function is invoked as part of `cfFilterImageToRaster()`, the caller passes a look-up-table during whose processing the out of bounds memory acces",
"evidence": "osv:DEBIAN-CVE-2025-57812",
"products": [
{
"name": {
"value": "cups-filters",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1.28.17-3+deb12u2",
"evidence": "/affected/0/ranges"
}
],
"affected_versions": [
{
"value": "1.28.17-3",
"evidence": "/affected/0/versions"
},
{
"value": "1.28.17-3+deb12u1",
"evidence": "/affected/0/versions"
}
]
},
{
"name": {
"value": "cups-filters",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1.28.17-6+deb13u1",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": [
{
"value": "1.28.17-6",
"evidence": "/affected/1/versions"
}
]
},
{
"name": {
"value": "cups-filters",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1.28.17-7",
"evidence": "/affected/2/ranges"
}
],
"affected_versions": [
{
"value": "1.28.17-6",
"evidence": "/affected/2/versions"
}
]
},
{
"name": {
"value": "libcupsfilters",
"evidence": "/affected/3/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "2.0.0-3+deb13u1",
"evidence": "/affected/3/ranges"
}
],
"affected_versions": [
{
"value": "2.0.0-3",
"evidence": "/affected/3/versions"
}
]
},
{
"name": {
"value": "libcupsfilters",
"evidence": "/affected/4/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "2.1.1-2",
"evidence": "/affected/4/ranges"
}
],
"affected_versions": [
{
"value": "2.0.0-3",
"evidence": "/affected/4/versions"
},
{
"value": "2.1.1-1",
"evidence": "/affected/4/versions"
}
]
}
],
"severity": "low",
"structured": {
"id": "DEBIAN-CVE-2025-57812",
"aliases": [
"DEBIAN-CVE-2025-57812"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.28.17-3+deb12u2"
}
]
}
],
"package": {
"name": "cups-filters",
"purl": "pkg:deb/debian/cups-filters?arch=source&distro=bookworm",
"ecosystem": "Debian:12"
},
"versions": [
"1.28.17-3",
"1.28.17-3+deb12u1"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2025-57812.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.28.17-6+deb13u1"
}
]
}
],
"package": {
"name": "cups-filters",
"purl": "pkg:deb/debian/cups-filters?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"versions": [
"1.28.17-6"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2025-57812.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.28.17-7"
}
]
}
],
"package": {
"name": "cups-filters",
"purl": "pkg:deb/debian/cups-filters?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"versions": [
"1.28.17-6"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2025-57812.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.0.0-3+deb13u1"
}
]
}
],
"package": {
"name": "libcupsfilters",
"purl": "pkg:deb/debian/libcupsfilters?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"versions": [
"2.0.0-3"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2025-57812.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.1.1-2"
}
]
}
],
"package": {
"name": "libcupsfilters",
"purl": "pkg:deb/debian/libcupsfilters?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"versions": [
"2.0.0-3",
"2.1.1-1"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2025-57812.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
}
],
"modified": "2026-10-23T17:47:29.697010628Z",
"provider": "osv",
"upstream": [
"CVE-2025-57812"
],
"references": [
"https://security-tracker.debian.org/tracker/CVE-2025-57812"
]
},
"related_cves": [
{
"value": "CVE-2025-57812",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 417236,
"published_at": "2025-11-12T19:15:36.753+00:00"
}