The vulnerability (CVE-2025-58364) exists in the ipp_read_io() function of the CUPS printing system, which improperly validates printer attribute responses. This improper validation can cause a null pointer dereference, resulting in a crash of the libcups process and denial-of-service. The issue can be exploited remotely within local subnets without requiring authentication or user interaction. If IPP services are exposed to the internet, remote exploitation is possible. Red Hat classifies this vulnerability as moderate severity with a CVSS v3 base score of 6.5 (AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). No official patch or mitigation is currently available from Red Hat that meets their deployment and stability criteria.

Successful exploitation causes a denial-of-service by crashing the CUPS printing service, disrupting printing capabilities on affected systems. There is no confidentiality or integrity impact reported. The vulnerability can be triggered remotely within local networks without authentication, and potentially over the internet if IPP services are exposed. No known exploits are currently observed in the wild.

Red Hat currently does not provide a mitigation or patch that meets their criteria for ease of use, applicability, and stability. Users are advised to monitor Red Hat advisories for updates. Restricting network exposure of IPP services to trusted networks may reduce risk. No official fix is available at this time.