CVE-2008-3639: Apple Cups

High severity, CVSS 7.5. EPSS: 4.4% chance of exploitation in the next 30 days.

Heap-based buffer overflow in the read_rle16 function in imagetops in CUPS before 1.3.9 allows remote attackers to execute arbitrary code via an SGI image with malformed Run Length Encoded (RLE) data containing a small image and a large row count.

Affected products

• Apple Cups: up to and including 1.3.8; version 1.1 only; version 1.1.1 only; version 1.1.2 only; version 1.1.3 only; version 1.1.4 only; …

Published 2008-10-14. Last modified 2026-06-16.