CVE-2026-64611 is a denial-of-service vulnerability in libcupsfilters where the cfIEEE1284NormalizeMakeModel() function enters an infinite loop upon receiving a malformed IEEE-1284 device ID with an empty model field. This infinite loop causes sustained CPU exhaustion. The flaw can be triggered by a network-adjacent attacker broadcasting a specially crafted printer advertisement. Red Hat rates this vulnerability as Moderate due to the cups-browsed daemon being disabled by default in their distributions. The issue is tracked under CWE-835 (Loop with Unreachable Exit Condition). Red Hat has released security updates for Red Hat Enterprise Linux 10 and its variants to fix this vulnerability.

The vulnerability allows a network-adjacent attacker to cause sustained CPU resource exhaustion on affected systems by sending malformed IEEE-1284 device IDs, resulting in denial of service. There is no impact on confidentiality or integrity. The affected component is cups-browsed, which is disabled by default in Red Hat Enterprise Linux, limiting the attack surface. The CVSS v3.1 base score is 7.5 (High) with an attack vector of network, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality or integrity impact, and high availability impact.

Red Hat has released an official security update that fixes this vulnerability. Applying the update to libcupsfilters on Red Hat Enterprise Linux 10 and related variants will remediate the issue. If automatic network printer discovery is not required, disabling the cups-browsed service completely eliminates the vulnerable attack surface. If cups-browsed must be used, network controls should be implemented to prevent untrusted networks from sending data to the daemon. Refer to the Red Hat advisory and update instructions at https://access.redhat.com/articles/11258 for detailed remediation steps.