CVE-2025-58364

What it actually does

Unsafe deserialization and validation of printer attributes in libcups leads to null pointer dereference, causing cups and cups-browsed processes to crash.

Why it matters to the business

Disrupts printing services across all Linux machines on a local network by default, halting print operations and requiring service restarts; exposure widens to remote network if prior cups-filters issues remain unpatched and IPP ports are reachable from the internet.

How an attack unfolds

An attacker on the same local subnet crafts malicious printer attributes inside IPP requests and sends them to listening CUPS instances, triggering the null dereference and service crash; on unfixed systems with public IPP exposure the attack can originate from the internet.

How to fix it

Upgrade OpenPrinting CUPS to version 2.4.13 or later; apply commit eee59dd0b55a0b11b80bda6ca437d60fee5faa09; restrict IPP traffic to trusted adjacent networks until patched.

How to confirm the fix worked

Confirm installed version is 2.4.13 or newer; attempt to reproduce the crash with known triggering attribute values in a test environment; monitor process stability after upgrade.

Typical attack path

1. Scan local subnet for CUPS or cups-browsed services listening on IPP ports
2. Craft and transmit IPP requests containing malformed printer attributes
3. Trigger null dereference in libcups deserialization path
4. Observe service crash and repeat to sustain denial of service

How to detect it

Review CUPS access and error logs for repeated malformed attribute submissions from the same source; correlate sudden cups or cups-browsed process restarts with network connection timestamps; examine firewall logs for unexpected IPP traffic.

What your security team should do

• Immediately upgrade all CUPS installations to 2.4.13
• Block or filter inbound IPP traffic from untrusted networks
• Audit for and remediate any remaining CVE-2024-47176 exposures
• Add CUPS version checks to vulnerability scanning policies