Loading story…
Red Hat released Moderate-severity security updates for libcupsfilters and cups-filters to address CVE-2026-64612, a denial-of-service flaw that can crash CUPS image filter processes when they parse a malformed PNG file. The bug affects libcupsfilters through version 2.1.1 and cups-filters through version 1.28.17, where the PNG parsing routines _cfImageReadPNG() and _cupsImageReadPNG() create a libpng read structure without a custom error handler or setjmp-based recovery. On parse errors, libpng falls back to its default behavior and calls abort(), allowing an unauthenticated attacker who can submit an image print job to terminate imagetoraster or imagetopdf with SIGABRT.
Red Hat said the issue has been remediated in RHEL 10 under advisory RHSA-2026:56965 and in RHEL 8 under RHSA-2026:57451, with updated packages distributed across multiple architectures and lifecycle variants. The RHEL 10 advisory also fixes CVE-2026-64611, a separate libcupsfilters flaw that can cause CPU exhaustion through an infinite loop in cfIEEE1284NormalizeMakeModel(). Fixed package versions include libcupsfilters-2.0.0-13.el10_2 for RHEL 10 and cups-filters-1.20.0-36.el8_10.1 for RHEL 8, while Red Hat's bug tracking notes indicated no upstream fix was available at the time of publication.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
On 2026-08-20, Red Hat published Moderate-severity advisory RHSA-2026:57451 for cups-filters in Red Hat Enterprise Linux 8. The update fixes CVE-2026-64612 and ships cups-filters version 1.20.0-36.el8_10.1 for supported RHEL 8 architectures and related variants.
On 2026-08-19, Red Hat published security advisory RHSA-2026:56965, rated Moderate, for libcupsfilters in Red Hat Enterprise Linux 10. The update provides libcupsfilters-2.0.0-13.el10_2 and fixes CVE-2026-64611 and CVE-2026-64612 across multiple RHEL 10 architectures and variants.
A Red Hat Bugzilla entry describes CVE-2026-64612 as a denial-of-service flaw in libcupsfilters and cups-filters PNG parsing, where malformed PNG input can trigger libpng's default abort behavior and crash imagetoraster or imagetopdf. The entry states no upstream fix is available and notes Red Hat addressed the issue in RHEL 10 via RHSA-2026:56965 and in RHEL 8 via RHSA-2026:57451.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
access.redhat.com
Open sourcebugzilla.redhat.com
Open sourceaccess.redhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released **Important** security updates for `image-builder` on **Red Hat Enterprise Linux 9** and **RHEL 10**, addressing eight vulnerabilities in bundled and dependent Go components. The flaws include **CVE-2025-61726**, a denial-of-service issue in Go's `net/url` form parsing that can exhaust memory through excessive unique query parameters, alongside **CVE-2025-68121**, **CVE-2026-25679**, **CVE-2026-27137**, **CVE-2026-32282**, **CVE-2026-32283**, **CVE-2026-33186`, and `CVE-2026-34986**. Red Hat said the affected issues span memory exhaustion, authorization bypass, denial of service, incorrect certificate or constraint validation, incorrect IPv6 parsing, and symlink-following behavior. The updates apply to multiple RHEL product variants and architectures, including `x86_64`, `s390x`, `ppc64le`, and `aarch64`, as well as Extended Update Support, Extended Life Cycle, SAP, and 4-year support channels. Red Hat shipped fixed packages as **`image-builder-52.1-1.el9_8`** for RHEL 9.8 and **`image-builder-52.1-1.el10_2`** for RHEL 10. Related Red Hat advisories also patched Go-based packages such as `ipp-usb` and `go-toolset`, underscoring broader exposure to the `net/url` memory-exhaustion flaw and other Go security defects across the enterprise Linux portfolio.
Aug 20, 2026
Red Hat released **Important** security updates for OpenSSL across multiple **RHEL 9** and **RHEL 10** channels to address two high-impact vulnerabilities, **`CVE-2025-15467`** and **`CVE-2025-69419`**. The first flaw affects parsing of CMS `AuthEnvelopedData` with AEAD ciphers, where an oversized initialization vector can overflow a fixed-size stack buffer before authentication or tag verification, creating a path to denial of service and possible remote code execution. The second flaw is a memory corruption bug in PKCS#12 processing, where `BMPString` to UTF-8 conversion can trigger an out-of-bounds heap write when an application parses an attacker-controlled PKCS#12 file, potentially causing a crash or arbitrary code execution. Upstream fixes were issued in OpenSSL **3.0.19**, **3.3.6**, **3.4.4**, **3.5.5**, **3.6.1**, and **1.1.1ze** for the affected branches, while OpenSSL **1.0.2** is not affected and the OpenSSL FIPS modules are outside the vulnerable code paths. Red Hat advisories including **RHSA-2026:1496**, **RHSA-2026:1503**, **RHSA-2026:1519**, **RHSA-2026:1594**, and **RHSA-2026:1733** cover impacted products such as RHEL 9.0, 9.2, 9.4, 9.6, and 10.0 variants, along with related SAP, AUS, EUS, OpenShift, and JBoss Core Services offerings, with updated package builds released for major architectures including `x86_64`, `aarch64`, `ppc64le`, and `s390x`.
Aug 20, 2026
Red Hat released Important-rated security updates for `urllib3` across Red Hat Enterprise Linux 8, 9, and 10 to remediate `CVE-2026-44432` and `CVE-2026-44431`. The more severe issue, `CVE-2026-44432`, is a denial-of-service flaw in the Python HTTP client library that can let a remote attacker force excessive CPU and memory consumption when `urllib3` fully decompresses an HTTP response even though only a partial read was requested, or when it drains a connection after partial decompression. Red Hat assigned the bug a CVSS v3 score of 7.5 and mapped it to `CWE-409`. The advisories cover multiple package streams and architectures, including `python-urllib3` for RHEL 10, `python3.14-urllib3` for RHEL 9 and 10, and `python3.12-urllib3` for RHEL 8 and 9, with fixes delivered in versions such as `1.26.19-4.el10_2`, `2.6.3-2.el10_2`, `2.6.3-2.el9_8`, `1.26.19-3.el9_8`, and `1.26.19-3.el8_10`. Red Hat said the same updates also address `CVE-2026-44431`, an information disclosure flaw in which sensitive headers may be forwarded across origins during redirects, and listed affected offerings including Extended Update Support, Extended Life Cycle releases, and Red Hat Ansible Automation Platform 2.5 and 2.6 as fixed.
Aug 20, 2026