Vulnerability in Opengroup Unix
CVE-2025-61915
OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to version 2.4.15, a user in the lpadmin group can use the cups web ui to change the config and insert a malicious line. Then the cupsd process which runs as root will parse the new config and cause an out-of-bound write. This issue has been patched in version 2.4.15.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 6.0 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H.
EPSS exploit prediction
EPSS: 0.005 (38.7th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 39th percentile — 38.7% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.005 · newest: 0.005 · change: 0.000
Affected products
- Opengroup Unix
- Openprinting Cups — versions < 2.4.15
Weakness classification (CWE)
References
- github.com/OpenPrinting/cups/security/advisories/GHSA-hxm8-vfpq-jrfc (Exploit, Vendor Advisory)
- github.com/OpenPrinting/cups/commit/db8d560262c22a21ee1e55dfd62fa98d9359bcb0 (Patch)
- github.com/OpenPrinting/cups/releases/tag/v2.4.15 (Release Notes)
- af854a3a-2127-422b-91ae-364da2661108 (Mailing List, Third Party Advisory)
Frequently asked questions
- What is CVE-2025-61915?
- CVE-2025-61915 is a medium-severity vulnerability in Opengroup Unix, classified under Buffer Underwrite. CVSS score: 6.0/10. Published 2025-11-29.
- How severe is CVE-2025-61915?
- Medium severity. CVSS v3 base score is 6.0 out of 10.