Infinite Loop in Printer IEEE-1284 Device ID Processing

CVE-2026-64611 exploits a flaw in libcupsfilters where the cfIEEE1284NormalizeMakeModel() function enters an infinite loop when processing printer advertisements containing an empty model field in the IEEE-1284 device ID string. This vulnerability enables network-adjacent attackers to trigger sustained CPU consumption through specially crafted printer broadcasts, resulting in denial of service. The impact is particularly significant for organizations managing networked printing infrastructure, including enterprises, educational institutions, and service providers that rely on CUPS (Common Unix Printing System) for printer management. Systems running vulnerable versions of libcupsfilters become susceptible to resource exhaustion attacks that require minimal attacker sophistication and can be executed from any network position adjacent to the target environment.

While this CVE currently maps to zero Casky skills due to its focus on a specific library function vulnerability rather than established ATT&CK techniques, Casky's Claude-powered analysis would detect the underlying attack pattern through resource consumption anomalies and network printer enumeration activities. Practitioners would identify suspicious indicators including: abnormal CPU spikes correlating with printer discovery traffic, repeated IEEE-1284 device ID queries from unknown network sources, and printer advertisement packets with malformed or empty model fields in CUPS logs. Extended reasoning would recognize this as an indirect Denial of Service attack (ATT&CK T1499) achieved through resource exhaustion, with detection logic focusing on sustained CPU utilization patterns, network printer reconnaissance, and anomalous CUPS service behavior—allowing teams to isolate affected systems and implement network segmentation around printer infrastructure before exploitation occurs.