CVE-2025-61915CWE-124CWE-129

CVE-2025-61915

Medium · published November 29, 2025

CVSS v3.1
6.0
EPSS
0%
Percentile
39.1
In the wild
Unconfirmed
What it is

OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to version 2.4.15, a user in the lpadmin group can use the cups web ui to change the config and insert a malicious line. Then the cupsd process which runs as root will parse the new config and cause an out-of-bound write. This issue has been patched in version 2.4.15.

The record
Technical detail
CVSS v3.1
6.0 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00462 · 39.1th percentile
Weaknesses
CWE-124 · Buffer Underwrite ('Buffer Underflow'); CWE-129 · Improper Validation of Array Index
Published
2025-11-29T08:15Z
Affected products (1)
ProductVersionsFixed in
openprinting/cups< 2.4.152.4.15
References (5)
https://github.com/OpenPrinting/cups/commit/db8d560262c22a21ee1e55dfd62fa98d9359bcb0 · [email protected]https://github.com/OpenPrinting/cups/releases/tag/v2.4.15 · [email protected]https://github.com/OpenPrinting/cups/security/advisories/GHSA-hxm8-vfpq-jrfc · [email protected]http://www.openwall.com/lists/oss-security/2025/11/27/5 · af854a3a-2127-422b-91ae-364da2661108https://github.com/OpenPrinting/cups/security/advisories/GHSA-hxm8-vfpq-jrfc · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 29 NOV 02:15Z
    OpenPrinting CUPS vulnerable to stack based out-of-bound write
    cvelistv5