CVE-2025-58364 is a medium severity vulnerability affecting OpenPrinting's CUPS (Common UNIX Printing System) versions prior to 2.4.13. The flaw arises from improper input validation and unsafe deserialization of printer attributes within the libcups library, leading to a null pointer dereference (CWE-476) and ultimately causing a denial of service (DoS) condition. This vulnerability can be triggered remotely within a local subnet due to default configurations where machines listen for printer broadcasts. When exploited, it causes the cups and cups-browsed services to crash on all affected machines in the local network, disrupting printing services. The vulnerability is exacerbated on systems that have not patched a related issue (CVE-2024-47176) and where firewalls do not block incoming IPP (Internet Printing Protocol) port traffic, potentially allowing network-based exploitation from outside the local subnet if the machine is exposed to the public internet. The attack vector is primarily adjacent network (AV:A), requiring no privileges or user interaction, and impacts availability without affecting confidentiality or integrity. The patched version 2.4.13 addresses this issue. No known exploits are currently reported in the wild.

For European organizations, this vulnerability poses a significant risk to operational continuity, especially in environments heavily reliant on Linux or Unix-like systems with default CUPS configurations. The denial of service can disrupt printing infrastructure across local networks, affecting business processes that depend on printing services such as document handling, invoicing, and administrative workflows. In critical sectors like healthcare, finance, and government, such disruptions could delay essential operations. Additionally, if systems remain unpatched and exposed to the internet without proper firewall restrictions, attackers could remotely trigger DoS attacks, expanding the threat beyond local networks. While the vulnerability does not compromise data confidentiality or integrity, the availability impact can lead to productivity losses and potential reputational damage. The lack of required privileges or user interaction lowers the barrier for exploitation within local networks, increasing the likelihood of attack in poorly secured environments.

European organizations should prioritize upgrading CUPS installations to version 2.4.13 or later to apply the official patch addressing CVE-2025-58364. Network administrators must audit firewall configurations to ensure that IPP ports (typically TCP 631) are blocked from untrusted networks, especially the public internet, to prevent remote exploitation. Disabling or restricting cups-browsed and printer discovery services on machines where printing is not required can reduce the attack surface. Implementing network segmentation to isolate printing services from general user networks can limit the impact of potential attacks. Monitoring logs for unusual crashes or service restarts related to cups or cups-browsed can help detect exploitation attempts. Additionally, organizations should verify that related vulnerabilities such as CVE-2024-47176 are also mitigated to avoid compounded risks. Regular vulnerability scanning and patch management processes should include CUPS and associated printing components to maintain security posture.