Loading story…
HP disclosed two serious vulnerabilities in HP Linux Imaging and Printing (HPLIP) that can lead to arbitrary code execution and privilege escalation on Linux hosts using the widely deployed printer and scanner framework. The most severe issue, CVE-2026-8631 with CVSS 9.3, is tied to an integer overflow in the hpcups processing path and could allow an unauthenticated network attacker to send crafted print data that triggers remote code execution or elevated privileges on the target system.
A second flaw, CVE-2026-8632 with CVSS 8.5, affects script wrappers through improper input validation and allows a local low-privileged user to execute commands as root. HP’s advisory HPSBPI04118 Rev. 1 attributes the issues to command injection and buffer overflow classes and says HPLIP 3.26.4 contains the fixes. Because HPLIP is commonly preinstalled in enterprise Linux distributions, organizations were urged to inventory affected systems, limit exposure of print service ports, and update software and firmware promptly.
See affected versions and whether adversaries are exploiting it.
4 events from the most recent confirmed update back to the earliest known activity.
Public reporting disclosed CVE-2026-14544, a critical HPLIP vulnerability described as an incomplete fix for CVE-2026-8631. The flaw involves an integer overflow in the hpcups processing path that could let a remote attacker achieve arbitrary code execution or privilege escalation via crafted print data.
Public reporting described CVE-2026-8631 as a critical flaw in the hpcups processing path that could let an unauthenticated network attacker send crafted print data to achieve arbitrary code execution or privilege escalation, and CVE-2026-8632 as a local privilege escalation issue in script wrappers. The disclosures also noted the broad exposure due to HPLIP being widely preinstalled on Linux systems.
In the advisory, HP stated that HPLIP version 3.26.4 contains the update that mitigates the disclosed vulnerabilities. HP recommended users keep systems updated with the latest software and firmware.
On 2026-05-20, HP disclosed two vulnerabilities in HP Linux Imaging and Printing Software (HPLIP) in advisory HPSBPI04118 Rev. 1. The issues were identified as command injection and buffer overflow flaws and assigned CVE-2026-8631 and CVE-2026-8632.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
8 references tracked. Mallory keeps watching after this page renders.
bugzilla.redhat.com
Open sourcecvefeed.io
Open sourcesecurityonline.info
Open sourceseclists.org
Open sourcebugzilla.suse.com
Open sourcesupport.hp.com
Open sourceaccess.redhat.com
Open sourcesecurity-tracker.debian.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
HP has fixed two serious vulnerabilities in **HP Linux Imaging and Printing Software (HPLIP)** affecting versions earlier than **`3.26.4`**, including a critical flaw that could enable remote arbitrary code execution and a high-severity issue that could lead to local privilege escalation. HP published the advisory **`HPSBPI04118`** and released **HPLIP `3.26.4`** as the patched version. The most severe issue, **`CVE-2026-8631`**, is an integer buffer overflow in the **`hpcups`** print request processing path that can be exploited remotely and without authentication using specially crafted print data. A second flaw, **`CVE-2026-8632`**, stems from improper neutralization and could be abused by a local low-privileged user through a crafted print request to execute arbitrary commands on the host operating system. Organizations using HPLIP on Linux systems should upgrade to **`3.26.4`** or later immediately.
Jul 24, 2026
A critical vulnerability in HP Linux Imaging and Printing (**HPLIP**), tracked as **`CVE-2026-14544`**, allows unauthenticated remote attackers to trigger arbitrary code execution, privilege escalation, denial of service, or memory corruption by sending specially crafted print data to the **`hpcups`** processing path. The bug is an integer overflow (**`CWE-190`**) and has been rated **CVSS 9.8**. Researchers and downstream reporting described it as an incomplete fix for the earlier **`CVE-2026-8631`**, meaning prior remediation did not fully eliminate the underlying issue. The flaw affects HPLIP versions prior to **`3.26.4`** and has broad exposure because HPLIP is widely deployed on Linux systems that support HP printers. Upstream reportedly fixed the issue in **`3.26.4`**, while Linux vendors including Ubuntu, Debian, SUSE/openSUSE, Oracle Linux, and Red Hat have identified affected products or begun issuing and backporting updates; Red Hat said **RHEL 8, 9, and 10** are affected, while **RHEL 6 and 7** are not. Until patches are fully available across distributions, defenders have been urged to apply vendor security updates as they are released, restrict network exposure to printing services such as CUPS, isolate print servers, monitor print activity, and remove HPLIP where it is not required.
Jul 9, 2026
Multiple vulnerabilities in the Common Unix Printing System (**CUPS**) were publicly disclosed, including flaws that can be chained into **remote code execution** on affected Linux and Unix systems. Reporting described the issue as a critical CUPS-based RCE risk, while an `oss-security` disclosure listed multiple **CVEs** tied to the print server and related components, expanding the scope from a single bug to a broader set of weaknesses in widely deployed printing infrastructure. Subsequent coverage said AI agents were able to identify vulnerabilities in the same Linux and Unix print server stack, underscoring how quickly offensive research techniques can surface exploitable flaws in foundational services. Because CUPS is commonly enabled across enterprise and workstation environments, the disclosures raised concern that exposed or reachable print services could provide attackers with a path to execute code remotely, making patching, service exposure review, and printer-related attack surface reduction urgent priorities.
Jul 12, 2026