CVE-2026-8631
published 2026-05-20CVE-2026-8631: A potential security vulnerability has been identified in the HP Linux Imaging and Printing Software. This potential vulnerability may allow escalation of…
PriorityP264critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
1.81%
77.8th percentile
A potential security vulnerability has been identified in the HP Linux Imaging and Printing Software. This potential vulnerability may allow escalation of privileges and/or arbitrary code execution via an integer overflow in the hpcups processing path when handling crafted print data.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | hplip | — | — |
| hp | hplip | — | — |
| hp | linux_imaging_and_printing | < 3.26.4 | 3.26.4 |
| hp_inc | hp_linux_imaging_and_printing_software | < 3.26.4 | 3.26.4 |
| ubuntu | hplip | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →The vulnerability is triggered via the hpcups processing path when handling specially crafted print data — monitor for anomalous or oversized print job submissions to HPLIP's hpcups filter ↗
- →Exploitation can occur remotely without user interaction by submitting malicious print job content to the hpcups filter path — alert on unexpected process spawning or privilege changes from the 'lp' user ↗
- →Successful exploitation results in code execution or privilege escalation running as the 'lp' user — monitor for unexpected child processes or privilege escalation events originating from user 'lp' ↗
- →The vulnerable process/component is 'hpcups' — monitor execution of this binary and watch for integer overflow indicators such as unexpected memory allocation failures or crashes in hpcups ↗
- ·Red Hat Enterprise Linux 8, 9, and 10 are confirmed affected; RHEL 6 and 7 are confirmed NOT affected for the follow-on CVE-2026-14544 (incomplete fix) ↗
- ·CVE-2026-14544 is an incomplete fix for CVE-2026-8631 — patching for CVE-2026-8631 alone is insufficient; both CVEs must be addressed ↗
- ·Fedora fixed packages are hplip-3.26.4-7 for Fedora 43, 44, and 45 — verify patched version is deployed ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv4.09.3CRITICALCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat9.8CRITICAL
vendor_ubuntu9.8CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
HPLIP: Incomplete Fix for CVE-2026-8631
vendor_redhat·2026-07-03·CVSS 9.8
CVE-2026-14544 [CRITICAL] CWE-190 HPLIP: Incomplete Fix for CVE-2026-8631
HPLIP: Incomplete Fix for CVE-2026-8631
A flaw was found in HPLIP (HP Linux Imaging and Printing Software). This vulnerability, an incomplete fix for CVE-2026-8631, may allow a remote attacker to escalate privileges or achieve arbitrary code execution. This can occur through an integer overflow in the hpcups processing path when handling specially crafted print data.
Statement: This is an Important security flaw in the HPLIP hpcups component, where HPLIP is vulnerable to integer overflow when processing crafted print data. A remote attacker who can submit print job content to the hpcups filter path may achieve arbitrary code execution or privilege escalation within user used for starting filters (user 'lp' by default) on systems using HPLIP for printing.
Mitigation: To mitigate this vul
Ubuntu
HPLIP vulnerabilities
vendor_ubuntu·2026-06-30·CVSS 9.8
CVE-2026-8632 [CRITICAL] HPLIP vulnerabilities
Title: HPLIP vulnerabilities
Summary: Several security issues were fixed in HPLIP.
It was discovered that HPLIP incorrectly handled certain print data. An
attacker could possibly use this issue to cause HPLIP to execute arbitrary
code. (CVE-2026-8631)
It was discovered that HPLIP incorrectly handled certain inputs. A local
attacker could possibly use this issue to execute arbitrary code.
(CVE-2026-8632)
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
HPLIP: HPLIP: Arbitrary code execution and privilege escalation via integer overflow in hpcups
vendor_redhat·2026-05-20·CVSS 9.3
CVE-2026-8631 [CRITICAL] CWE-190 HPLIP: HPLIP: Arbitrary code execution and privilege escalation via integer overflow in hpcups
HPLIP: HPLIP: Arbitrary code execution and privilege escalation via integer overflow in hpcups
A flaw was found in HP Linux Imaging and Printing Software (HPLIP). This vulnerability, caused by an integer overflow in the hpcups processing path, occurs when the software handles specially crafted print data. A successful exploit could lead to arbitrary code execution or escalation of privileges on the affected system.
Statement: This Important flaw in HPLIP's hpcups component allows for arbitrary code execution and privilege escalation. The vulnerability can be triggered remotely without user interaction by processing specially crafted print data, posing a significant risk to systems with HPLIP installed.
Package: hplip (Red Hat Enterprise Linux 10) - Under investigation
Package: hplip (R
GHSA
A flaw was found in HPLIP (HP Linux Imaging and Printing Software).
ghsa_unreviewed·2026-07-03·CVSS 9.8
CVE-2026-14544 [CRITICAL] CWE-190 A flaw was found in HPLIP (HP Linux Imaging and Printing Software).
A flaw was found in HPLIP (HP Linux Imaging and Printing Software). This vulnerability, an incomplete fix for CVE-2026-8631, may allow a remote attacker to escalate privileges or achieve arbitrary code execution. This can occur through an integer overflow in the hpcups processing path when handling specially crafted print data.
GHSA
GHSA-hcc9-h975-pvc2: A potential security vulnerability has been identified in the HP Linux Imaging and Printing Software
ghsa_unreviewed·2026-05-20
CVE-2026-8631 [CRITICAL] CWE-122 GHSA-hcc9-h975-pvc2: A potential security vulnerability has been identified in the HP Linux Imaging and Printing Software
A potential security vulnerability has been identified in the HP Linux Imaging and Printing Software. This potential vulnerability may allow escalation of privileges and/or arbitrary code execution via an integer overflow in the hpcups processing path when handling crafted print data.
VulDB
HP Linux Imaging and Printing Software up to 3.26.3 heap-based overflow
vuldb·2026-05-20·CVSS 9.3
CVE-2026-8631 [CRITICAL] HP Linux Imaging and Printing Software up to 3.26.3 heap-based overflow
A vulnerability identified as critical has been detected in HP Linux Imaging and Printing Software up to 3.26.3. This vulnerability affects unknown code. The manipulation leads to heap-based buffer overflow.
This vulnerability is documented as CVE-2026-8631. The attack can be initiated remotely. There is not any exploit available.
You should upgrade the affected component.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-14544 hplip: Incomplete Fix for CVE-2026-8631 [fedora-all]
bugzilla·2026-07-03·CVSS 9.8
CVE-2026-14544 [CRITICAL] CVE-2026-14544 hplip: Incomplete Fix for CVE-2026-8631 [fedora-all]
CVE-2026-14544 hplip: Incomplete Fix for CVE-2026-8631 [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Incomplete Fix for CVE-2026-8631.
A potential security vulnerability has been identified in the HP Linux Imaging and Printing Software. This potential vulnerability may allow escalation of privileges and/or arbitrary code execution via an integer overflow in the hpcups processing path when handling crafted print data.
Discussion:
FEDORA-2026-c5b6bb47c5 (hplip-3.26.4-7.fc45) has been submitted as an update to Fedora 45.
https://bodhi.fedoraproject.org/updates/FEDORA-2026-c5b6bb47c5
---
FEDORA-2026
Bugzilla
CVE-2026-14544 HPLIP: Incomplete Fix for CVE-2026-8631
bugzilla·2026-07-03·CVSS 9.8
CVE-2026-14544 [CRITICAL] CVE-2026-14544 HPLIP: Incomplete Fix for CVE-2026-8631
CVE-2026-14544 HPLIP: Incomplete Fix for CVE-2026-8631
Incomplete Fix for CVE-2026-8631.
During development of the fix for CVE-2026-8631 an issue was introduced in hpcups, which made the fix for CVE-2026-8631 incomplete. The original fix was protecting result of multiplication of several variables, which are influenced by crafted input file, from integer overflow. The core of the new flaw is that it protects multiplication of one different pair of variables, leaving the one variable which can be influenced by input file unchecked, which can result in arbitrary cod
Bugzilla
CVE-2026-8631 hplip: HPLIP: Arbitrary code execution and privilege escalation via integer overflow in hpcups [fedora-all]
bugzilla·2026-05-26·CVSS 9.3
CVE-2026-8631 [CRITICAL] CVE-2026-8631 hplip: HPLIP: Arbitrary code execution and privilege escalation via integer overflow in hpcups [fedora-all]
CVE-2026-8631 hplip: HPLIP: Arbitrary code execution and privilege escalation via integer overflow in hpcups [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Bugzilla
CVE-2026-8631 HPLIP: HPLIP: Arbitrary code execution and privilege escalation via integer overflow in hpcups
bugzilla·2026-05-20·CVSS 9.3
CVE-2026-8631 [CRITICAL] CVE-2026-8631 HPLIP: HPLIP: Arbitrary code execution and privilege escalation via integer overflow in hpcups
CVE-2026-8631 HPLIP: HPLIP: Arbitrary code execution and privilege escalation via integer overflow in hpcups
A potential security vulnerability has been identified in the HP Linux Imaging and Printing Software. This potential vulnerability may allow escalation of privileges and/or arbitrary code execution via an integer overflow in the hpcups processing path when handling crafted print data.
Hackernews
ThreatsDay Bulletin: Linux Rootkits, Router 0-Day, AI Intrusions, Scam Kits and 25 New Stories
blogs_hackernews·2026-05-21
CVE-2026-45793 ThreatsDay Bulletin: Linux Rootkits, Router 0-Day, AI Intrusions, Scam Kits and 25 New Stories
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## ThreatsDay Bulletin: Linux Rootkits, Router 0-Day, AI Intrusions, Scam Kits and 25 New Stories
This week starts small.
A token leaks. A bad package slips in. A login trick works. An old tool shows up again. At first, it feels like the usual mess. Then you see the pattern: attackers are not always breaking in. They are using the parts we already trust.
That is what makes it worrying. The danger is in normal things now - updates, apps, cloud buttons, support chats, trusted accounts. AI does not make the attacks magic. It just helps people try more things, faster.
Here's what showed up this week.
The Pwn2Own Berlin 2026 hack
https://support.hp.com/us-en/document/ish_14942099-14942126-16/hpsbpi04118https://access.redhat.com/errata/RHSA-2026:26228https://access.redhat.com/errata/RHSA-2026:26297https://access.redhat.com/errata/RHSA-2026:26335https://access.redhat.com/errata/RHSA-2026:48171https://access.redhat.com/errata/RHSA-2026:48586https://access.redhat.com/errata/RHSA-2026:48603https://access.redhat.com/errata/RHSA-2026:48606https://access.redhat.com/errata/RHSA-2026:48959https://access.redhat.com/errata/RHSA-2026:48960https://access.redhat.com/errata/RHSA-2026:48961https://access.redhat.com/security/cve/CVE-2026-8631https://bugzilla.redhat.com/show_bug.cgi?id=2480300https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-8631.json
2026-05-20
Published