CVE-2025-57812

CUPS is a standards-based, open-source printing system, and libcupsfilters contains the code of the filters of the former cups-filters package as library functions to be used for the data format conversion tasks needed in Printer Applications. In CUPS-Filters versions up to and including 1.28.17 and libscupsfilters versions 2.0.0 through 2.1.1, CUPS-Filters's imagetoraster filter has an out of bounds read/write vulnerability in the processing of TIFF image files. While the pixel buffer is allocated with the number of pixels times a pre-calculated bytes-per-pixel value, the function which processes these pixels is called with a size of the number of pixels times 3. When suitable inputs are passed, the bytes-per-pixel value can be set to 1 and bytes outside of the buffer bounds get processed. In order to trigger the bug, an attacker must issue a print job with a crafted TIFF file, and pass appropriate print job options to control the bytes-per-pixel value of the output format. They must choose a printer configuration under which the imagetoraster filter or its C-function equivalent cfFilterImageToRaster() gets invoked. The vulnerability exists in both CUPS-Filters 1.x and the successor library libcupsfilters (CUPS-Filters 2.x). In CUPS-Filters 2.x, the vulnerable function is _cfImageReadTIFF() in libcupsfilters. When this function is invoked as part of cfFilterImageToRaster(), the caller passes a look-up-table during whose processing the out of bounds memory access happens. In CUPS-Filters 1.x, the equivalent functions are all found in the cups-filters repository, which is not split into subprojects yet, and the vulnerable code is in _cupsImageReadTIFF(), which is called through cupsImageOpen() from the imagetoraster tool. A patch is available in commit b69dfacec7f176281782e2f7ac44f04bf9633cfa.

Database specific

{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-125",
        "CWE-787"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/57xxx/CVE-2025-57812.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "libcupsfilters >= 2.0.0, < 2.1.1"
                },
                {
                    "last_affected": "libcupsfilters >= 2.0.0, < 2.1.1"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ]
}

References

Affected packages

Git / github.com/openprinting/cups-filters

Affected ranges

Type

GIT

Repo

https://github.com/openprinting/cups-filters

Events

Introduced

deceb54f7c6935683732de936364eb82c0d32dbb

Fixed

deceb54f7c6935683732de936364eb82c0d32dbb

Database specific

Show details

{
    "cpe": "cpe:2.3:a:openprinting:cups-filters:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "cups-filters <= 1.28.17"
        },
        {
            "last_affected": "cups-filters <= 1.28.17"
        },
        {
            "introduced": "0"
        },
        {
            "fixed": "1.28.17"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "CPE_RANGE"
    ]
}

Type

GIT

Repo

https://github.com/openprinting/libcupsfilters

Events

Introduced

a75f7e5acb22db5fa8c939889c31ae61c64ce7ad

Fixed

fb2a4a25d90b05dd2b034af0589c13f5856532f2

Fixed

b69dfacec7f176281782e2f7ac44f04bf9633cfa

Database specific

Show details

{
    "cpe": "cpe:2.3:a:openprinting:libcupsfilters:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "2.0.0"
        },
        {
            "fixed": "2.1.1"
        }
    ],
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ]
}

Affected versions

2.*

2.0.0

2.1.0

2.1.1

2.1b1

cups-filters <= 1.*

cups-filters <= 1.28.17

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-57812.json"

vanir_signatures

[
    {
        "deprecated": false,
        "digest": {
            "function_hash": "42061243208070445012433084390695591297",
            "length": 28354
        },
        "id": "CVE-2025-57812-4b514f94",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/openprinting/libcupsfilters/commit/b69dfacec7f176281782e2f7ac44f04bf9633cfa",
        "target": {
            "file": "cupsfilters/image-tiff.c",
            "function": "_cfImageReadTIFF"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "144092593580005849854924672436864359879",
                "268467096553739066157191709429381230563",
                "73408120116374618912511194460729732022",
                "259688319932037534707326190093504878263",
                "278637253073213825274842409204617117298",
                "328876288284172116653315108458453719210",
                "284318475568752388442543439574439151862",
                "35793819940051320735723399004621636386",
                "276274438708956468648106533399562029955",
                "45298253840901734379500417749883328203",
                "303718138438959447101012788654697268729",
                "287523501029936878676155523795954706719",
                "295531895687332224484492994010739423243",
                "47766084698459693366748869305166719487",
                "234595296254816083432546770438148117004",
                "24016057993650718314721635921641132991",
                "332908557626701948156169608162874374485",
                "255283499068089034843772883205291415346",
                "11202868597098166405204363879487117969",
                "187934681950567824374783233702268724098"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2025-57812-57828aab",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/openprinting/libcupsfilters/commit/b69dfacec7f176281782e2f7ac44f04bf9633cfa",
        "target": {
            "file": "cupsfilters/image-tiff.c"
        }
    }
]

vanir_signatures_modified

"2026-08-12T15:14:08Z"