CVE-2008-5286: Apple Cups

High severity, CVSS 7.5. EPSS: 4.4% chance of exploitation in the next 30 days.

Integer overflow in the _cupsImageReadPNG function in CUPS 1.1.17 through 1.3.9 allows remote attackers to execute arbitrary code via a PNG image with a large height value, which bypasses a validation check and triggers a buffer overflow.

Affected products

• Apple Cups: version 1.1.17 only; version 1.1.18 only; version 1.1.19 only; version 1.1.20 only; version 1.1.21 only; version 1.1.22 only; …

Published 2008-12-01. Last modified 2026-06-16.