libcupsfilters through 2.1.1 and cups-filters through 1.28.17 contain a denial-of-service flaw in _cfImageReadPNG() (2.x) / _cupsImageReadPNG() (1.x) in cupsfilters/image-png.c. The function creates the libpng read struct with png_create_read_struct(PNG_LIBPNG_VER_STRING, NULL, NULL, NULL) without installing a custom error handler or setjmp(png_jmpbuf(pp)) recovery frame. On any libpng parse error the default error handler calls abort(), terminating the filter process (SIGABRT, exit 134). An unauthenticated client that can submit an image print job can crash the imagetoraster/imagetopdf filter with a single malformed PNG. CWE-248. No upstream fix available.