CVE-2008-3641 [Critical] | Security Vulnerability in Cups

CVE-2008-3641 is rated High Exploit Risk (85.4/100): CVSS Critical severity, with high exploitation likelihood (EPSS 51.27%, 98th percentile). 2 public exploit reference(s) are indexed (Exploit-DB). Public exploits are available—assess exposure, apply mitigations, and prioritize patching.

EDB-ID	Source	Kind	Published	Link
32470	exploit_db	edb	2008-10-09	Exploit-DB ↗
—	nvd_ref	exploit_tag		Exploit-DB ↗

EDB-ID

Source

Kind

Published

Link

32470

exploit_db

edb

2008-10-09

Exploit-DB ↗

—

nvd_ref

exploit_tag

Exploit-DB ↗

#	Date	Old EPSS score	New EPSS score	Delta (New - Old)
1	2026-05-01	55.18%	51.27%	-3.91%
2	2026-03-06	48.77%	55.18%	+6.41%
3	2026-03-04	—	48.77%	—

Date

Old EPSS score

New EPSS score

Delta (New - Old)

2026-05-01

55.18%

51.27%

-3.91%

2026-03-06

48.77%

55.18%

+6.41%

2026-03-04

—

48.77%

—

Base score	Version	Severity	Vector	Exploitability	Impact	Score source
10.0	2.0	HIGH	`AV:N/AC:L/Au:N/C:C/I:C/A:C` Click to expand Access vector (AV:N) Can be exploited remotely over network reachability. Access complexity (AC:L) Exploitation conditions are straightforward and predictable. Authentication (AU:N) No authentication is required. Confidentiality impact (C:C) Complete confidentiality impact. Integrity impact (I:C) Complete integrity impact. Availability impact (A:C) Complete availability impact.	10.0	10.0	[email protected]

Base score

Version

Severity

Vector

Exploitability

Impact

Score source

10.0

2.0

HIGH

AV:N/AC:L/Au:N/C:C/I:C/A:C Click to expand

Access vector (AV:N): Can be exploited remotely over network reachability.
Access complexity (AC:L): Exploitation conditions are straightforward and predictable.
Authentication (AU:N): No authentication is required.
Confidentiality impact (C:C): Complete confidentiality impact.
Integrity impact (I:C): Complete integrity impact.
Availability impact (A:C): Complete availability impact.

10.0

[email protected]

OS Trackers for CVE-2008-3641

vendor	priority	summary	link
`debian`	medium	CVE-2008-3641 medium priority: Debian including 1 source packages (cups), 5 status rows across 5 suites (bookworm, bullseye, forky, sid, trixie): resolved 5.	https://security-tracker.debian.org/tracker/CVE-2008-3641
`gentoo`	high	CVE-2008-3641: 1 GLSA(s) (200812-11), 1 atom(s) (net-print/cups); latest impact high.	https://bugs.gentoo.org/buglist.cgi?quicksearch=CVE-2008-3641
`redhat`	high	—	https://access.redhat.com/security/cve/CVE-2008-3641
`suse`	medium	CVE-2008-3641 severity moderate: SUSE including 46 source package names (cups-1.3.9-8.30.1, cups-1.3.9-8.44.1, …), 46 product×package rows across 10 product lines (SUSE Linux Enterprise Module for Legacy 12, SUSE Linux Enterprise Server 11 SP1, … (10 product lines)): Fixed 42, Known Not Affected 4.	https://www.suse.com/security/cve/CVE-2008-3641/
`ubuntu`	high	CVE-2008-3641 high priority: Ubuntu including 2 source packages (cups, cupsys), 10 status rows across 5 suites (dapper, feisty, gutsy, hardy, upstream): released 6, DNE 4.	https://ubuntu.com/security/CVE-2008-3641

Affected software / configurations for CVE-2008-3641

Vendor	Product	Version	Raw CPE
apple	cups	<= 1.3.8	cpe:2.3:a:apple:cups::::::::
apple	cups	1.1	cpe:2.3:a:apple:cups:1.1:::::::*
apple	cups	1.1.1	cpe:2.3:a:apple:cups:1.1.1:::::::*
apple	cups	1.1.2	cpe:2.3:a:apple:cups:1.1.2:::::::*
apple	cups	1.1.3	cpe:2.3:a:apple:cups:1.1.3:::::::*
apple	cups	1.1.4	cpe:2.3:a:apple:cups:1.1.4:::::::*
apple	cups	1.1.5	cpe:2.3:a:apple:cups:1.1.5:::::::*
apple	cups	1.1.5-1	cpe:2.3:a:apple:cups:1.1.5-1:::::::*
apple	cups	1.1.5-2	cpe:2.3:a:apple:cups:1.1.5-2:::::::*
apple	cups	1.1.6	cpe:2.3:a:apple:cups:1.1.6:::::::*
apple	cups	1.1.6-1	cpe:2.3:a:apple:cups:1.1.6-1:::::::*
apple	cups	1.1.6-2	cpe:2.3:a:apple:cups:1.1.6-2:::::::*
apple	cups	1.1.6-3	cpe:2.3:a:apple:cups:1.1.6-3:::::::*
apple	cups	1.1.7	cpe:2.3:a:apple:cups:1.1.7:::::::*
apple	cups	1.1.8	cpe:2.3:a:apple:cups:1.1.8:::::::*
apple	cups	1.1.9	cpe:2.3:a:apple:cups:1.1.9:::::::*
apple	cups	1.1.9-1	cpe:2.3:a:apple:cups:1.1.9-1:::::::*
apple	cups	1.1.10	cpe:2.3:a:apple:cups:1.1.10:::::::*
apple	cups	1.1.10-1	cpe:2.3:a:apple:cups:1.1.10-1:::::::*
apple	cups	1.1.11	cpe:2.3:a:apple:cups:1.1.11:::::::*
apple	cups	1.1.12	cpe:2.3:a:apple:cups:1.1.12:::::::*
apple	cups	1.1.13	cpe:2.3:a:apple:cups:1.1.13:::::::*
apple	cups	1.1.14	cpe:2.3:a:apple:cups:1.1.14:::::::*
apple	cups	1.1.15	cpe:2.3:a:apple:cups:1.1.15:::::::*
apple	cups	1.1.16	cpe:2.3:a:apple:cups:1.1.16:::::::*
apple	cups	1.1.17	cpe:2.3:a:apple:cups:1.1.17:::::::*
apple	cups	1.1.18	cpe:2.3:a:apple:cups:1.1.18:::::::*
apple	cups	1.1.19	cpe:2.3:a:apple:cups:1.1.19:::::::*
apple	cups	1.1.19	cpe:2.3:a:apple:cups:1.1.19:rc1::::::
apple	cups	1.1.19	cpe:2.3:a:apple:cups:1.1.19:rc2::::::
apple	cups	1.1.19	cpe:2.3:a:apple:cups:1.1.19:rc3::::::
apple	cups	1.1.19	cpe:2.3:a:apple:cups:1.1.19:rc4::::::
apple	cups	1.1.19	cpe:2.3:a:apple:cups:1.1.19:rc5::::::
apple	cups	1.1.20	cpe:2.3:a:apple:cups:1.1.20:::::::*
apple	cups	1.1.20	cpe:2.3:a:apple:cups:1.1.20:rc1::::::
apple	cups	1.1.20	cpe:2.3:a:apple:cups:1.1.20:rc2::::::
apple	cups	1.1.20	cpe:2.3:a:apple:cups:1.1.20:rc3::::::
apple	cups	1.1.20	cpe:2.3:a:apple:cups:1.1.20:rc4::::::
apple	cups	1.1.20	cpe:2.3:a:apple:cups:1.1.20:rc5::::::
apple	cups	1.1.20	cpe:2.3:a:apple:cups:1.1.20:rc6::::::
apple	cups	1.1.21	cpe:2.3:a:apple:cups:1.1.21:::::::*
apple	cups	1.1.21	cpe:2.3:a:apple:cups:1.1.21:rc1::::::
apple	cups	1.1.21	cpe:2.3:a:apple:cups:1.1.21:rc2::::::
apple	cups	1.1.22	cpe:2.3:a:apple:cups:1.1.22:::::::*
apple	cups	1.1.22	cpe:2.3:a:apple:cups:1.1.22:rc1::::::
apple	cups	1.1.22	cpe:2.3:a:apple:cups:1.1.22:rc2::::::
apple	cups	1.1.23	cpe:2.3:a:apple:cups:1.1.23:::::::*
apple	cups	1.1.23	cpe:2.3:a:apple:cups:1.1.23:rc1::::::
apple	cups	1.2	cpe:2.3:a:apple:cups:1.2:b1::::::
apple	cups	1.2	cpe:2.3:a:apple:cups:1.2:b2::::::
apple	cups	1.2	cpe:2.3:a:apple:cups:1.2:rc1::::::
apple	cups	1.2	cpe:2.3:a:apple:cups:1.2:rc2::::::
apple	cups	1.2	cpe:2.3:a:apple:cups:1.2:rc3::::::
apple	cups	1.2.0	cpe:2.3:a:apple:cups:1.2.0:::::::*
apple	cups	1.2.1	cpe:2.3:a:apple:cups:1.2.1:::::::*
apple	cups	1.2.2	cpe:2.3:a:apple:cups:1.2.2:::::::*
apple	cups	1.2.3	cpe:2.3:a:apple:cups:1.2.3:::::::*
apple	cups	1.2.4	cpe:2.3:a:apple:cups:1.2.4:::::::*
apple	cups	1.2.5	cpe:2.3:a:apple:cups:1.2.5:::::::*
apple	cups	1.2.6	cpe:2.3:a:apple:cups:1.2.6:::::::*
apple	cups	1.2.7	cpe:2.3:a:apple:cups:1.2.7:::::::*
apple	cups	1.2.8	cpe:2.3:a:apple:cups:1.2.8:::::::*
apple	cups	1.2.9	cpe:2.3:a:apple:cups:1.2.9:::::::*
apple	cups	1.2.10	cpe:2.3:a:apple:cups:1.2.10:::::::*
apple	cups	1.2.11	cpe:2.3:a:apple:cups:1.2.11:::::::*
apple	cups	1.2.12	cpe:2.3:a:apple:cups:1.2.12:::::::*
apple	cups	1.3	cpe:2.3:a:apple:cups:1.3:b1::::::
apple	cups	1.3	cpe:2.3:a:apple:cups:1.3:rc1::::::
apple	cups	1.3	cpe:2.3:a:apple:cups:1.3:rc2::::::
apple	cups	1.3.0	cpe:2.3:a:apple:cups:1.3.0:::::::*
apple	cups	1.3.1	cpe:2.3:a:apple:cups:1.3.1:::::::*
apple	cups	1.3.2	cpe:2.3:a:apple:cups:1.3.2:::::::*
apple	cups	1.3.3	cpe:2.3:a:apple:cups:1.3.3:::::::*
apple	cups	1.3.4	cpe:2.3:a:apple:cups:1.3.4:::::::*
apple	cups	1.3.5	cpe:2.3:a:apple:cups:1.3.5:::::::*
apple	cups	1.3.6	cpe:2.3:a:apple:cups:1.3.6:::::::*
apple	cups	1.3.7	cpe:2.3:a:apple:cups:1.3.7:::::::*

References for CVE-2008-3641

URL	Tags
http://lists.apple.com/archives/security-announce/2008/Oct/msg00001.html	Vendor Advisory
http://lists.opensuse.org/opensuse-security-announce/2008-10/msg00006.html
http://lists.opensuse.org/opensuse-security-announce/2009-01/msg00004.html
http://secunia.com/advisories/32084	Vendor Advisory
http://secunia.com/advisories/32222	Vendor Advisory
http://secunia.com/advisories/32226	Vendor Advisory
http://secunia.com/advisories/32284	Vendor Advisory
http://secunia.com/advisories/32292	Vendor Advisory
http://secunia.com/advisories/32316	Vendor Advisory
http://secunia.com/advisories/32331
http://secunia.com/advisories/33085
http://secunia.com/advisories/33111
http://secunia.com/advisories/33568
http://sunsolve.sun.com/search/document.do?assetkey=1-26-261088-1
http://support.apple.com/kb/HT3216	Vendor Advisory
http://support.avaya.com/elmodocs2/security/ASA-2008-470.htm
http://www.cups.org/articles.php?L575
http://www.cups.org/str.php?L2911	Exploit
http://www.debian.org/security/2008/dsa-1656
http://www.gentoo.org/security/en/glsa/glsa-200812-11.xml
http://www.mandriva.com/security/advisories?name=MDVSA-2008:211
http://www.redhat.com/support/errata/RHSA-2008-0937.html
http://www.securityfocus.com/archive/1/497221/100/0/threaded
http://www.securityfocus.com/bid/31681	Patch
http://www.securityfocus.com/bid/31688
http://www.securitytracker.com/id?1021031
http://www.vupen.com/english/advisories/2008/2780
http://www.vupen.com/english/advisories/2008/2782
http://www.vupen.com/english/advisories/2008/3401
http://www.vupen.com/english/advisories/2009/1568
http://www.zerodayinitiative.com/advisories/ZDI-08-067
https://exchange.xforce.ibmcloud.com/vulnerabilities/45779
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9666
https://usn.ubuntu.com/656-1/
https://www.redhat.com/archives/fedora-package-announce/2008-October/msg00331.html
https://www.redhat.com/archives/fedora-package-announce/2008-October/msg00380.html

URL

CVE-2008-3641

Public exploit references (Exploit-DB) for CVE-2008-3641

Exploit prediction scoring system (EPSS) score for CVE-2008-3641

Common vulnerability scoring system (CVSS) metrics for CVE-2008-3641

Weakness enumeration for CVE-2008-3641

OS Trackers for CVE-2008-3641

Affected software / configurations for CVE-2008-3641

References for CVE-2008-3641