CVE-2026-64612 is a denial-of-service vulnerability in libcupsfilters and cups-filters where the PNG image reading function creates a libpng reader without an error recovery handler. When processing a malformed PNG file, this causes the CUPS image filter process to abort. An unauthenticated attacker can exploit this by submitting a specially crafted PNG print job, causing the in-flight print job to fail. The vulnerability is tracked as CWE-248 (Uncaught Exception). Red Hat has issued security advisories and updates for Red Hat Enterprise Linux 10 to fix this issue.

The vulnerability allows an unauthenticated attacker to cause a denial of service by crashing the CUPS image filter process during the processing of a malformed PNG print job. This impacts only the in-flight print job and does not affect the overall stability of the CUPS printing service. There is no confidentiality or integrity impact reported.

Red Hat has released security updates for libcupsfilters in Red Hat Enterprise Linux 10 to address this vulnerability. Users should apply the available updates as described in the Red Hat advisory (RHSA-2026:56965) to remediate the issue. No alternative mitigations meeting Red Hat's criteria are currently available. Systems running affected versions should be updated promptly to prevent denial of service.