Skip to content
OpenAdvisories
Critical USN-9037-1 10 CVEs

hplip vulnerabilities

Published Nov 10, 2026 · Updated Nov 11, 2026

Ecosystem: Ubuntu

Summary

It was discovered that HPLIP did not properly handle certain data, which
could result in an out-of-bounds write. An attacker could possibly use this
issue to cause a denial of service, expose sensitive information or execute
arbitrary code. (CVE-2026-91097)

It was discovered that HPLIP did not properly handle certain input, which
could result in a heap-based buffer overflow. An attacker could possibly
use this issue to cause a denial of service, expose sensitive information
or execute arbitrary code. (CVE-2026-91098)

It was discovered that HPLIP created certain files with insecure
permissions. An attacker could possibly use this issue to expose or modify
sensitive information. (CVE-2026-91099)

It was discovered that HPLIP did not properly handle certain input while
issuing an OS command. An attacker could possibly use this issue to execute
arbitrary commands. This issue only affected Ubuntu 16.04 LTS and Ubuntu
18.04 LTS. (CVE-2026-91100)

It was discovered that HPLIP did not properly validate certain array
indices. An attacker could possibly use this issue to cause a denial of
service, expose sensitive information or execute arbitrary code.
(CVE-2026-91101)

It was discovered that HPLIP did not properly handle certain input while
issuing an OS command. An attacker could possibly use this issue to execute
arbitrary commands. (CVE-2026-91102)

It was discovered that HPLIP did not properly handle certain numeric
values, which could result in an integer underflow. An attacker could
possibly use this issue to cause a denial of service, expose sensitive
information or execute arbitrary code. (CVE-2026-91103)

It was discovered that HPLIP did not properly handle certain input, which
could result in a heap-based buffer overflow. An attacker could possibly
use this issue to cause a denial of service, expose sensitive information
or execute arbitrary code. (CVE-2026-91104, CVE-2026-91105, CVE-2026-91106)

Fixed packages 7

ReleasePackageFixed in
Ubuntu · 22.04 LTS 22.04:LTS hplip 3.21.12+dfsg0-1ubuntu0.3
Ubuntu · 24.04 LTS 24.04:LTS hplip 3.23.12+dfsg0-0ubuntu5.3
Ubuntu · 26.04 LTS 26.04:LTS hplip 3.24.4+dfsg0-0ubuntu8.3
Ubuntu · 26.10 hplip 3.24.4+dfsg0-0ubuntu10.2
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS hplip 3.16.3+repack0-1ubuntu0.1~esm2
Ubuntu · Pro 18.04 LTS Pro:18.04:LTS hplip 3.17.10+repack0-5ubuntu0.1~esm2
Ubuntu · Pro 20.04 LTS Pro:20.04:LTS hplip 3.20.3+dfsg0-2ubuntu0.1+esm2

Vulnerabilities 10

References

  • report
    https://ubuntu.com/security/CVE-2026-91097
  • report
    https://ubuntu.com/security/CVE-2026-91098
  • report
    https://ubuntu.com/security/CVE-2026-91099
  • report
    https://ubuntu.com/security/CVE-2026-91100
  • report
    https://ubuntu.com/security/CVE-2026-91101
  • report
    https://ubuntu.com/security/CVE-2026-91102
  • report
    https://ubuntu.com/security/CVE-2026-91103
  • report
    https://ubuntu.com/security/CVE-2026-91104
  • report
    https://ubuntu.com/security/CVE-2026-91105
  • report
    https://ubuntu.com/security/CVE-2026-91106