Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.8
Rocky Linux HPLIP may allow attackers to run code
published 19 days ago
Summary
The HPLIP package used for HP printers on Rocky Linux contains several flaws that could let a local or remote attacker run their own programs, gain higher privileges, or cause the system to stop working. Update the HPLIP package to the latest version to protect your printers and keep the system stable.
What to do
- Update rocky hplip to version 0:3.26.6-1.el9_8.3.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Rocky Linux:9 | rocky | hplip |
< 0:3.26.6-1.el9_8.3 Fix: upgrade to 0:3.26.6-1.el9_8.3
|
Original advisory text
Important: hplip security, bug fix, and enhancement update
The hplip packages contain the Hewlett-Packard Linux Imaging and Printing Project (HPLIP), which provides drivers for Hewlett-Packard printers and multi-function peripherals.
Security Fix(es):
* hplip: HP Linux Imaging and Printing Software - Use of DSA Key (CVE-2025-43023)
* hplip: HPLIP: Multiple vulnerabilities enabling local code execution and privilege escalation (CVE-2026-91099)
* hplip: HPLIP: Multiple vulnerabilities allow remote code execution and privilege escalation (CVE-2026-91098)
* hplip: HPLIP: Multiple vulnerabilities enable remote code execution and privilege escalation (CVE-2026-91097)
* hplip: HPLIP: Multiple vulnerabilities leading to remote code execution, privilege escalation, and denial of service (CVE-2026-91103)
* hplip: heap-based buffer overflow can lead to remote code execution (CVE-2026-91106)
* hplip: HPLIP: Multiple vulnerabilities allow remote code execution, privilege escalation, and denial of service. (CVE-2026-91100)
* hplip: HPLIP: Remote Code Execution and Privilege Escalation Vulnerabilities (CVE-2026-91101)
* hplip: heap-based buffer overflow can lead to remote code execution (CVE-2026-91104)
* hplip: HPLIP: Remote code execution and privilege escalation vulnerabilities (CVE-2026-91105)
* HPLIP: HPLIP: Multiple vulnerabilities could lead to remote code execution (CVE-2026-91102)
Bug Fix(es) and Enhancement(s):
* [IMAGE-MODE] missing /var/lib/hp on image-mode (JIRA:Rocky Linux-257310)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Security Fix(es):
* hplip: HP Linux Imaging and Printing Software - Use of DSA Key (CVE-2025-43023)
* hplip: HPLIP: Multiple vulnerabilities enabling local code execution and privilege escalation (CVE-2026-91099)
* hplip: HPLIP: Multiple vulnerabilities allow remote code execution and privilege escalation (CVE-2026-91098)
* hplip: HPLIP: Multiple vulnerabilities enable remote code execution and privilege escalation (CVE-2026-91097)
* hplip: HPLIP: Multiple vulnerabilities leading to remote code execution, privilege escalation, and denial of service (CVE-2026-91103)
* hplip: heap-based buffer overflow can lead to remote code execution (CVE-2026-91106)
* hplip: HPLIP: Multiple vulnerabilities allow remote code execution, privilege escalation, and denial of service. (CVE-2026-91100)
* hplip: HPLIP: Remote Code Execution and Privilege Escalation Vulnerabilities (CVE-2026-91101)
* hplip: heap-based buffer overflow can lead to remote code execution (CVE-2026-91104)
* hplip: HPLIP: Remote code execution and privilege escalation vulnerabilities (CVE-2026-91105)
* HPLIP: HPLIP: Multiple vulnerabilities could lead to remote code execution (CVE-2026-91102)
Bug Fix(es) and Enhancement(s):
* [IMAGE-MODE] missing /var/lib/hp on image-mode (JIRA:Rocky Linux-257310)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
References
- https://errata.rockylinux.org/RLSA-2026:82882 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2384011 Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2535600 Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2535603 Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2535607 Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2535613 Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2535614 Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2535615 Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2535617 Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2535618 Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2535621 Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2535622 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2026:82882 Vendor Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker full control (estimated)
Timeline
Published16 Oct 2026
Updated16 Oct 2026
First seen16 Oct 2026
Sources
RLSA-2026:82882 · OSV
Track software like this
Free during beta