HP Fixes Critical HPLIP Vulnerabilities

TL;DR

HP released security updates fixing ten security defects in its official Linux printing suite. These flaws allow remote attackers to execute arbitrary code or trigger denial of service without authentication. Therefore, organizations running Linux desktop fleets must update HPLIP to version 3.26.6 immediately.

Notable CVEs

Why This Matters

Sourced estimates indicate that millions of Linux workstations and print servers rely on HPLIP drivers for hardware support. Because print spoolers often process untrusted network documents, software flaws in print stacks create significant security risks. If attackers exploit these weaknesses, they can seize control of core system processes. Furthermore, unauthorized users can escalate local privileges to root and modify critical system configuration files.

How the Attack Works

The security flaws reside within various driver and parsing libraries across the printing software. According to the advisory, “The findings affect several software components that could potentially enable remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification under certain conditions.”

Network attackers can transmit crafted print requests to vulnerable endpoints without providing valid credentials. As a result, flaws like CVE-2026-91106 and CVE-2026-91104 trigger memory corruption with CVSS 4.0 scores of 9.3. Additionally, local attackers can trigger buffer flaws to write arbitrary files to restricted locations. Currently, HP has confirmed no active in-the-wild exploitation or public proof-of-concept exploits for these issues.

Affected Versions

These HPLIP vulnerabilities affect all software versions prior to version 3.26.6 across supported Linux distributions.

Patch and Mitigation Steps

Administrators should update their printing packages to HPLIP version 3.26.6 or later without delay. Users can download the latest installation packages directly through their distribution package managers or the vendor portal. For additional guidance, review the official HP security advisory. Moreover, administrators should isolate network printers within dedicated management subnets to limit exposure.

×

Support Our Threat Intelligence

Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!

Buy Me a Coffee

PayPal

Select your plan

Free Pro Team

Hover over a plan to see its benefits.

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.