This update for cups-filters fixes the following issues:
Changes in cups-filters:
- No longer provide the serial backend with 0700 permissions
so cupsd does no longer run it as root but as usual
as user 'lp' to avoid CVE-2026-95511
"Root arbitrary file overwrite via serial ... device-URI path"
https://github.com/OpenPrinting/cups-filters/security/advisories/GHSA-m74w-wg6q-vvpj
"`lpadmin` user can escalate privileges to `root` via printers
that uses a privileged serial backend" (bsc#1282291)
Note the general security advice in the section
"Allow printer admin tasks for a normal user" in
https://en.opensuse.org/SDB:CUPS_in_
This update for cups-filters fixes the following issues:
Changes in cups-filters:
- CVE-2026-64611: Fixed Infinite-loop CPU-exhaustion DoS in
cfIEEE1284NormalizeMakeModel on empty MDL field.
A user who controls an IEEE-1284 device ID consumed by
`cfIEEE1284GetMakeModel` can drive
`cfIEEE1284NormalizeMakeModel` into an infinite loop.
(bsc#1273145,GHSA-rcq7-rv5g-j3r4)
- CVE-2026-64612: Fixed Malformed PNG aborts CUPS image filter process
(missing libpng setjmp recovery)
A authenticated client that can submit an image print job
can abort the CUPS filter process by supplying a malformed PNG.
(bsc#1273146,GHSA-7mxj-cfq5-8