Loading story…
A critical vulnerability in HP Linux Imaging and Printing (HPLIP), tracked as CVE-2026-14544, allows unauthenticated remote attackers to trigger arbitrary code execution, privilege escalation, denial of service, or memory corruption by sending specially crafted print data to the hpcups processing path. The bug is an integer overflow (CWE-190) and has been rated CVSS 9.8. Researchers and downstream reporting described it as an incomplete fix for the earlier CVE-2026-8631, meaning prior remediation did not fully eliminate the underlying issue.
The flaw affects HPLIP versions prior to 3.26.4 and has broad exposure because HPLIP is widely deployed on Linux systems that support HP printers. Upstream reportedly fixed the issue in 3.26.4, while Linux vendors including Ubuntu, Debian, SUSE/openSUSE, Oracle Linux, and Red Hat have identified affected products or begun issuing and backporting updates; Red Hat said RHEL 8, 9, and 10 are affected, while RHEL 6 and 7 are not. Until patches are fully available across distributions, defenders have been urged to apply vendor security updates as they are released, restrict network exposure to printing services such as CUPS, isolate print servers, monitor print activity, and remove HPLIP where it is not required.
See real exploitation activity before you spend the cycle.
4 events from the most recent confirmed update back to the earliest known activity.
Cyber Security News reports that Red Hat confirmed RHEL 8, 9, and 10 are affected by CVE-2026-14544, while RHEL 6 and 7 are not. The same report says no official patches were yet available for affected Red Hat versions at disclosure time.
According to ThreatAft, Linux distributions including Ubuntu, Debian, SUSE/openSUSE, and Oracle Linux are issuing or backporting fixes for CVE-2026-14544. This reflects downstream vendor response following the upstream fix.
ThreatAft reports that upstream addressed CVE-2026-14544 in HPLIP version 3.26.4. The flaw affects versions prior to 3.26.4 and can enable remote privilege escalation or arbitrary code execution through the hpcups print-processing path.
The sources state that CVE-2026-14544 is an incomplete fix bypass for the earlier HPLIP vulnerability CVE-2026-8631, meaning prior remediation did not fully address the underlying issue.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
HP disclosed two serious vulnerabilities in **HP Linux Imaging and Printing (HPLIP)** that can lead to arbitrary code execution and privilege escalation on Linux hosts using the widely deployed printer and scanner framework. The most severe issue, **`CVE-2026-8631`** with **CVSS 9.3**, is tied to an integer overflow in the **`hpcups`** processing path and could allow an unauthenticated network attacker to send crafted print data that triggers remote code execution or elevated privileges on the target system. A second flaw, **`CVE-2026-8632`** with **CVSS 8.5**, affects script wrappers through improper input validation and allows a local low-privileged user to execute commands as **root**. HP’s advisory **`HPSBPI04118 Rev. 1`** attributes the issues to command injection and buffer overflow classes and says **HPLIP `3.26.4`** contains the fixes. Because HPLIP is commonly preinstalled in enterprise Linux distributions, organizations were urged to inventory affected systems, limit exposure of print service ports, and update software and firmware promptly.
Jul 3, 2026
HP has fixed two serious vulnerabilities in **HP Linux Imaging and Printing Software (HPLIP)** affecting versions earlier than **`3.26.4`**, including a critical flaw that could enable remote arbitrary code execution and a high-severity issue that could lead to local privilege escalation. HP published the advisory **`HPSBPI04118`** and released **HPLIP `3.26.4`** as the patched version. The most severe issue, **`CVE-2026-8631`**, is an integer buffer overflow in the **`hpcups`** print request processing path that can be exploited remotely and without authentication using specially crafted print data. A second flaw, **`CVE-2026-8632`**, stems from improper neutralization and could be abused by a local low-privileged user through a crafted print request to execute arbitrary commands on the host operating system. Organizations using HPLIP on Linux systems should upgrade to **`3.26.4`** or later immediately.
Jul 24, 2026
Researchers disclosed a high-impact vulnerability chain in **OpenPrinting CUPS** affecting version `2.4.16` and earlier that can let an unauthenticated remote attacker progress from network-reachable print-job submission to **code execution as `lp`** and then to a **root-level file overwrite**. The chain combines `CVE-2026-34980`, which abuses anonymous `Print-Job` requests against a shared PostScript queue, with `CVE-2026-34990`, an authorization flaw that lets a local unprivileged user coerce `cupsd` into authenticating to an attacker-controlled localhost IPP service and reuse a print admin token to overwrite root-owned files. Public advisories and proof-of-concept details were released by researcher Asim Viladi Oglu Manizada and OpenPrinting, and fixes were committed publicly even though no patched release was yet available. Defenders were urged to reduce exposure immediately because exploitation depends on reachable `cupsd` services, legacy shared queues, and permissive submission behavior rather than user interaction. Recommended mitigations include disabling or restricting network exposure of CUPS, requiring authentication for shared queue submissions, disabling shared legacy queues where possible, and confining the service with **SELinux** or **AppArmor**. Follow-on discussion noted that removing CUPS outright may be impractical on some Ubuntu systems because `cupsd` is commonly installed by default and intertwined with other packages, making service isolation and firewalling more realistic short-term controls.
Jun 29, 2026