CVE-2025-64503

{"id": "CVE-2025-64503", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-64503", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-13T16:56:00.686424Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.0, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.5}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.3, "attackVector": "LOCAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 1.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "OpenPrinting", "product": "cups-filters", "versions": [{"status": "affected", "version": "cups-filters < 1.28.18"}, {"status": "affected", "version": "libcupsfilters >= 2.0.0, < 2.1.2"}]}]}], "published": "2025-11-12T22:15:50.293", "references": [{"url": "https://github.com/OpenPrinting/cups-filters/blob/aea8d0db017e495b0204433ebdb0e86b4871094c/filter/pdftoraster.cxx#L1620", "tags": ["Product"], "source": "security-advisories@github.com"}, {"url": "https://github.com/OpenPrinting/cups-filters/blob/aea8d0db017e495b0204433ebdb0e86b4871094c/filter/pdftoraster.cxx#L1880", "tags": ["Product"], "source": "security-advisories@github.com"}, {"url": "https://github.com/OpenPrinting/cups-filters/commit/50d94ca0f2fa6177613c97c59791bde568631865", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/OpenPrinting/cups-filters/security/advisories/GHSA-893j-2wr2-wrh9", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/OpenPrinting/libcupsfilters/blob/1dd86d835b27ed149b66aee1a4853d1db8a1f44c/cupsfilters/pdftoraster.cxx#L1790", "tags": ["Product"], "source": "security-advisories@github.com"}, {"url": "http://www.openwall.com/lists/oss-security/2025/11/12/2", "tags": ["Mailing List", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-787"}]}], "descriptions": [{"lang": "en", "value": "cups-filters contains backends, filters, and other software required to get the cups printing service working on operating systems other than macos. In cups-filters prior to 1.28.18, by crafting a PDF file with a large `MediaBox` value, an attacker can cause CUPS-Filter 1.x\u2019s `pdftoraster` tool to write beyond the bounds of an array. First, a PDF with a large `MediaBox` width value causes `header.cupsWidth` to become large. Next, the calculation of `bytesPerLine = (header.cupsBitsPerPixel * header.cupsWidth + 7) / 8` overflows, resulting in a small value. Then, `lineBuf` is allocated with the small `bytesPerLine` size. Finally, `convertLineChunked` calls `writePixel8`, which attempts to write to `lineBuf` outside of its buffer size (out of bounds write). In libcupsfilters, the maintainers found the same `bytesPerLine` multiplication without overflow check, but the provided test case does not cause an overflow there, because the values are different. Commit 50d94ca0f2fa6177613c97c59791bde568631865 contains a patch, which is incorporated into cups-filters version 1.28.18."}, {"lang": "es", "value": "cups-filters contiene backends, filtros y otro software necesario para que el servicio de impresi\u00f3n CUPS funcione en sistemas operativos distintos de macOS. En cups-filters versiones anteriores a 1.28.18, al manipular un archivo PDF con un valor 'MediaBox' grande, un atacante puede hacer que la herramienta 'pdftoraster' de CUPS-Filter 1.x escriba m\u00e1s all\u00e1 de los l\u00edmites de un array. Primero, un PDF con un valor de ancho 'MediaBox' grande hace que 'header.cupsWidth' se vuelva grande. A continuaci\u00f3n, el c\u00e1lculo de 'bytesPerLine = (header.cupsBitsPerPixel * header.cupsWidth + 7) / 8' desborda, lo que resulta en un valor peque\u00f1o. Luego, 'lineBuf' se asigna con el tama\u00f1o peque\u00f1o de 'bytesPerLine'. Finalmente, 'convertLineChunked' llama a 'writePixel8', que intenta escribir en 'lineBuf' fuera del tama\u00f1o de su b\u00fafer (escritura fuera de l\u00edmites). En libcupsfilters, los mantenedores encontraron la misma multiplicaci\u00f3n de 'bytesPerLine' sin verificaci\u00f3n de desbordamiento, pero el caso de prueba proporcionado no causa un desbordamiento all\u00ed, porque los valores son diferentes. El commit 50d94ca0f2fa6177613c97c59791bde568631865 contiene un parche, que se incorpora en la versi\u00f3n 1.28.18 de cups-filters."}], "lastModified": "2026-10-18T20:10:00.110", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:openprinting:cups-filters:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1E8D664D-AE1E-4B08-8CB0-91A43C19EE27", "versionEndExcluding": "1.28.18"}, {"criteria": "cpe:2.3:a:openprinting:libcupsfilters:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D664D9C3-6C68-41D2-ADC0-A47B8003B47D", "versionEndExcluding": "2.1.2", "versionStartIncluding": "2.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}