RHSA-2026:82882
Vulnerability from csaf_redhat - Published: 2026-10-14 16:11 - Updated: 2026-10-14 22:56Summary
Red Hat Security Advisory: hplip security, bug fix, and enhancement update
Severity
Important
Notes
Topic: An update for hplip is now available for Red Hat Enterprise Linux 9.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details: The hplip packages contain the Hewlett-Packard Linux Imaging and Printing Project (HPLIP), which provides drivers for Hewlett-Packard printers and multi-function peripherals.
Security Fix(es):
* hplip: HP Linux Imaging and Printing Software - Use of DSA Key (CVE-2025-43023)
* hplip: HPLIP: Multiple vulnerabilities enabling local code execution and privilege escalation (CVE-2026-91099)
* hplip: HPLIP: Multiple vulnerabilities allow remote code execution and privilege escalation (CVE-2026-91098)
* hplip: HPLIP: Multiple vulnerabilities enable remote code execution and privilege escalation (CVE-2026-91097)
* hplip: HPLIP: Multiple vulnerabilities leading to remote code execution, privilege escalation, and denial of service (CVE-2026-91103)
* hplip: heap-based buffer overflow can lead to remote code execution (CVE-2026-91106)
* hplip: HPLIP: Multiple vulnerabilities allow remote code execution, privilege escalation, and denial of service. (CVE-2026-91100)
* hplip: HPLIP: Remote Code Execution and Privilege Escalation Vulnerabilities (CVE-2026-91101)
* hplip: heap-based buffer overflow can lead to remote code execution (CVE-2026-91104)
* hplip: HPLIP: Remote code execution and privilege escalation vulnerabilities (CVE-2026-91105)
* HPLIP: HPLIP: Multiple vulnerabilities could lead to remote code execution (CVE-2026-91102)
Bug Fix(es) and Enhancement(s):
* [IMAGE-MODE] missing /var/lib/hp on image-mode (JIRA:RHEL-257310)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in the HP Linux Imaging and Printing Software (HPLIP). This vulnerability is due to the use of a weak Digital Signature Algorithm (DSA) for code signing. A remote attacker could exploit this weakness to forge signatures, potentially leading to the execution of unauthorized code or tampering with the software. This could compromise the integrity and confidentiality of the affected system.
5.0 (Medium)
Affected products
Fixed
5 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.x86_64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
35 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.aarch64 | — |
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.i686 | — |
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.ppc64le | — |
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.s390x | — |
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.x86_64 | — |
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.aarch64 | — |
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.i686 | — |
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.ppc64le | — |
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.s390x | — |
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.x86_64 | — |
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.aarch64 | — |
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.i686 | — |
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.ppc64le | — |
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.s390x | — |
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.x86_64 | — |
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.aarch64 | — |
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.i686 | — |
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.ppc64le | — |
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.s390x | — |
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.x86_64 | — |
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.aarch64 | — |
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.i686 | — |
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.ppc64le | — |
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.s390x | — |
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.x86_64 | — |
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.aarch64 | — |
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.i686 | — |
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.ppc64le | — |
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.s390x | — |
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.x86_64 | — |
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.aarch64 | — |
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.i686 | — |
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.ppc64le | — |
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.s390x | — |
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.x86_64 | — |
Workaround
|
Threats
Impact
Moderate
A flaw was found in HPLIP (HP Linux Imaging and Printing) software. Multiple vulnerabilities exist that could allow a remote attacker to execute arbitrary code, escalate privileges, cause a denial of service, disclose sensitive information, or modify files without authorization. These issues arise under specific, unspecified conditions.
8.8 (High)
Affected products
Fixed
15 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.i686 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.i686 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.x86_64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
25 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.aarch64 | — |
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.i686 | — |
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.ppc64le | — |
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.s390x | — |
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.x86_64 | — |
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.aarch64 | — |
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.i686 | — |
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.ppc64le | — |
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.s390x | — |
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.x86_64 | — |
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.aarch64 | — |
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.i686 | — |
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.ppc64le | — |
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.s390x | — |
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.x86_64 | — |
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.aarch64 | — |
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.i686 | — |
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.ppc64le | — |
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.s390x | — |
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.x86_64 | — |
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.aarch64 | — |
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.i686 | — |
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.ppc64le | — |
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.s390x | — |
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.x86_64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in HP Linux Imaging and Printing (HPLIP) software. Multiple vulnerabilities exist that could allow a remote attacker to achieve remote code execution, escalate privileges, cause a denial of service, disclose information, or modify files without authorization under certain conditions.
8.8 (High)
Affected products
Fixed
15 products, the same list as for
CVE-2026-91097
Known not affected
25 products, the same list as for
CVE-2026-91097
Threats
Impact
Important
A flaw was found in HPLIP (HP Linux Imaging and Printing) software. Multiple vulnerabilities exist in several software components that could potentially allow a local attacker to achieve local code execution, escalate privileges, cause a denial of service (DoS), disclose sensitive information, or modify files without authorization under certain conditions.
5.1 (Medium)
Affected products
Fixed
15 products, the same list as for
CVE-2026-91097
Known not affected
25 products, the same list as for
CVE-2026-91097
Threats
Impact
Moderate
A flaw was found in HP Linux Imaging and Printing (HPLIP) Software. Multiple vulnerabilities in several software components could allow a remote attacker to execute arbitrary code, escalate privileges, or cause a denial of service. Additionally, these flaws could lead to information disclosure or unauthorized file modification under certain conditions.
6.6 (Medium)
Affected products
Fixed
15 products, the same list as for
CVE-2026-91097
Known not affected
25 products, the same list as for
CVE-2026-91097
Threats
Impact
Moderate
A flaw was found in HPLIP (HP Linux Imaging and Printing) software. Multiple vulnerabilities within several components could allow a remote attacker to execute code on the system, gain elevated privileges, or access sensitive information. These issues could also lead to a denial of service, making the system unavailable, or unauthorized changes to files under certain conditions.
4.6 (Medium)
Affected products
Fixed
15 products, the same list as for
CVE-2026-91097
Known not affected
25 products, the same list as for
CVE-2026-91097
Threats
Impact
Moderate
A flaw was found in HP Linux Imaging and Printing (HPLIP) software. Multiple vulnerabilities exist within several software components that could potentially allow an attacker to achieve remote code execution, escalate privileges, cause a denial of service, disclose information, or modify files without authorization under certain conditions.
7.8 (High)
Affected products
Fixed
15 products, the same list as for
CVE-2026-91097
Known not affected
25 products, the same list as for
CVE-2026-91097
Threats
Impact
Important
A flaw was found in HPLIP (HP Linux Imaging and Printing) software. This issue encompasses multiple vulnerabilities across several components, potentially allowing an attacker to achieve remote code execution, elevate their privileges, or cause a denial of service. Additionally, these flaws could lead to information disclosure or unauthorized file modification under certain conditions.
6.3 (Medium)
Affected products
Fixed
15 products, the same list as for
CVE-2026-91097
Known not affected
25 products, the same list as for
CVE-2026-91097
Threats
Impact
Moderate
A flaw was found in HPLIP. A heap-based buffer overflow could potentially allow an attacker to achieve code execution, escalate privileges, cause a denial of service, disclose sensitive information, or perform unauthorized file modifications under certain conditions.
8.4 (High)
Affected products
Fixed
15 products, the same list as for
CVE-2026-91097
Known not affected
25 products, the same list as for
CVE-2026-91097
Threats
Impact
Important
A flaw was found in HPLIP. Multiple vulnerabilities in several software components could potentially allow a remote attacker to achieve remote code execution or privilege escalation under certain conditions, requiring user interaction. These flaws could also lead to denial of service, information disclosure, or unauthorized file modification.
8.8 (High)
Affected products
Fixed
15 products, the same list as for
CVE-2026-91097
Known not affected
25 products, the same list as for
CVE-2026-91097
Threats
Impact
Important
A flaw was found in HPLIP. A heap-based buffer overflow could potentially allow an attacker to achieve code execution, escalate privileges, cause a denial of service, disclose sensitive information, or perform unauthorized file modifications under certain conditions.
8.4 (High)
Affected products
Fixed
15 products, the same list as for
CVE-2026-91097
Known not affected
25 products, the same list as for
CVE-2026-91097
Threats
Impact
Important
References
62 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for hplip is now available for Red Hat Enterprise Linux 9.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "The hplip packages contain the Hewlett-Packard Linux Imaging and Printing Project (HPLIP), which provides drivers for Hewlett-Packard printers and multi-function peripherals.\n\nSecurity Fix(es):\n\n* hplip: HP Linux Imaging and Printing Software - Use of DSA Key (CVE-2025-43023)\n\n* hplip: HPLIP: Multiple vulnerabilities enabling local code execution and privilege escalation (CVE-2026-91099)\n\n* hplip: HPLIP: Multiple vulnerabilities allow remote code execution and privilege escalation (CVE-2026-91098)\n\n* hplip: HPLIP: Multiple vulnerabilities enable remote code execution and privilege escalation (CVE-2026-91097)\n\n* hplip: HPLIP: Multiple vulnerabilities leading to remote code execution, privilege escalation, and denial of service (CVE-2026-91103)\n\n* hplip: heap-based buffer overflow can lead to remote code execution (CVE-2026-91106)\n\n* hplip: HPLIP: Multiple vulnerabilities allow remote code execution, privilege escalation, and denial of service. (CVE-2026-91100)\n\n* hplip: HPLIP: Remote Code Execution and Privilege Escalation Vulnerabilities (CVE-2026-91101)\n\n* hplip: heap-based buffer overflow can lead to remote code execution (CVE-2026-91104)\n\n* hplip: HPLIP: Remote code execution and privilege escalation vulnerabilities (CVE-2026-91105)\n\n* HPLIP: HPLIP: Multiple vulnerabilities could lead to remote code execution (CVE-2026-91102)\n\nBug Fix(es) and Enhancement(s):\n\n* [IMAGE-MODE] missing /var/lib/hp on image-mode (JIRA:RHEL-257310)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:82882",
"url": "https://access.redhat.com/errata/RHSA-2026:82882"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "2384011",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2384011"
},
{
"category": "external",
"summary": "2535600",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2535600"
},
{
"category": "external",
"summary": "2535603",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2535603"
},
{
"category": "external",
"summary": "2535607",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2535607"
},
{
"category": "external",
"summary": "2535613",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2535613"
},
{
"category": "external",
"summary": "2535614",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2535614"
},
{
"category": "external",
"summary": "2535615",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2535615"
},
{
"category": "external",
"summary": "2535617",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2535617"
},
{
"category": "external",
"summary": "2535618",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2535618"
},
{
"category": "external",
"summary": "2535621",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2535621"
},
{
"category": "external",
"summary": "2535622",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2535622"
},
{
"category": "external",
"summary": "RHEL-257310",
"url": "https://issues.redhat.com/browse/RHEL-257310"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_82882.json"
}
],
"title": "Red Hat Security Advisory: hplip security, bug fix, and enhancement update",
"tracking": {
"current_release_date": "2026-10-14T22:56:33+00:00",
"generator": {
"date": "2026-10-14T22:56:33+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.4.2"
}
},
"id": "RHSA-2026:82882",
"initial_release_date": "2026-10-14T16:11:09+00:00",
"revision_history": [
{
"date": "2026-10-14T16:11:09+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-10-14T16:11:09+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-10-14T22:56:33+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux AppStream (v. 9)",
"product": {
"name": "Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:enterprise_linux:9::appstream"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "hplip-0:3.26.6-1.el9_8.3.s390x",
"product": {
"name": "hplip-0:3.26.6-1.el9_8.3.s390x",
"product_id": "hplip-0:3.26.6-1.el9_8.3.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/hplip@3.26.6-1.el9_8.3?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "hplip-common-0:3.26.6-1.el9_8.3.s390x",
"product": {
"name": "hplip-common-0:3.26.6-1.el9_8.3.s390x",
"product_id": "hplip-common-0:3.26.6-1.el9_8.3.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/hplip-common@3.26.6-1.el9_8.3?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "hplip-libs-0:3.26.6-1.el9_8.3.s390x",
"product": {
"name": "hplip-libs-0:3.26.6-1.el9_8.3.s390x",
"product_id": "hplip-libs-0:3.26.6-1.el9_8.3.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/hplip-libs@3.26.6-1.el9_8.3?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "libsane-hpaio-0:3.26.6-1.el9_8.3.s390x",
"product": {
"name": "libsane-hpaio-0:3.26.6-1.el9_8.3.s390x",
"product_id": "libsane-hpaio-0:3.26.6-1.el9_8.3.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libsane-hpaio@3.26.6-1.el9_8.3?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "hplip-debugsource-0:3.26.6-1.el9_8.3.s390x",
"product": {
"name": "hplip-debugsource-0:3.26.6-1.el9_8.3.s390x",
"product_id": "hplip-debugsource-0:3.26.6-1.el9_8.3.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/hplip-debugsource@3.26.6-1.el9_8.3?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "hplip-debuginfo-0:3.26.6-1.el9_8.3.s390x",
"product": {
"name": "hplip-debuginfo-0:3.26.6-1.el9_8.3.s390x",
"product_id": "hplip-debuginfo-0:3.26.6-1.el9_8.3.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/hplip-debuginfo@3.26.6-1.el9_8.3?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.s390x",
"product": {
"name": "hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.s390x",
"product_id": "hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/hplip-libs-debuginfo@3.26.6-1.el9_8.3?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.s390x",
"product": {
"name": "libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.s390x",
"product_id": "libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libsane-hpaio-debuginfo@3.26.6-1.el9_8.3?arch=s390x"
}
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "hplip-0:3.26.6-1.el9_8.3.src",
"product": {
"name": "hplip-0:3.26.6-1.el9_8.3.src",
"product_id": "hplip-0:3.26.6-1.el9_8.3.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/hplip@3.26.6-1.el9_8.3?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "hplip-0:3.26.6-1.el9_8.3.aarch64",
"product": {
"name": "hplip-0:3.26.6-1.el9_8.3.aarch64",
"product_id": "hplip-0:3.26.6-1.el9_8.3.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/hplip@3.26.6-1.el9_8.3?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "hplip-common-0:3.26.6-1.el9_8.3.aarch64",
"product": {
"name": "hplip-common-0:3.26.6-1.el9_8.3.aarch64",
"product_id": "hplip-common-0:3.26.6-1.el9_8.3.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/hplip-common@3.26.6-1.el9_8.3?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "hplip-libs-0:3.26.6-1.el9_8.3.aarch64",
"product": {
"name": "hplip-libs-0:3.26.6-1.el9_8.3.aarch64",
"product_id": "hplip-libs-0:3.26.6-1.el9_8.3.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/hplip-libs@3.26.6-1.el9_8.3?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "libsane-hpaio-0:3.26.6-1.el9_8.3.aarch64",
"product": {
"name": "libsane-hpaio-0:3.26.6-1.el9_8.3.aarch64",
"product_id": "libsane-hpaio-0:3.26.6-1.el9_8.3.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libsane-hpaio@3.26.6-1.el9_8.3?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "hplip-debugsource-0:3.26.6-1.el9_8.3.aarch64",
"product": {
"name": "hplip-debugsource-0:3.26.6-1.el9_8.3.aarch64",
"product_id": "hplip-debugsource-0:3.26.6-1.el9_8.3.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/hplip-debugsource@3.26.6-1.el9_8.3?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "hplip-debuginfo-0:3.26.6-1.el9_8.3.aarch64",
"product": {
"name": "hplip-debuginfo-0:3.26.6-1.el9_8.3.aarch64",
"product_id": "hplip-debuginfo-0:3.26.6-1.el9_8.3.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/hplip-debuginfo@3.26.6-1.el9_8.3?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.aarch64",
"product": {
"name": "hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.aarch64",
"product_id": "hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/hplip-libs-debuginfo@3.26.6-1.el9_8.3?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.aarch64",
"product": {
"name": "libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.aarch64",
"product_id": "libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libsane-hpaio-debuginfo@3.26.6-1.el9_8.3?arch=aarch64"
}
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "hplip-0:3.26.6-1.el9_8.3.ppc64le",
"product": {
"name": "hplip-0:3.26.6-1.el9_8.3.ppc64le",
"product_id": "hplip-0:3.26.6-1.el9_8.3.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/hplip@3.26.6-1.el9_8.3?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "hplip-common-0:3.26.6-1.el9_8.3.ppc64le",
"product": {
"name": "hplip-common-0:3.26.6-1.el9_8.3.ppc64le",
"product_id": "hplip-common-0:3.26.6-1.el9_8.3.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/hplip-common@3.26.6-1.el9_8.3?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "hplip-libs-0:3.26.6-1.el9_8.3.ppc64le",
"product": {
"name": "hplip-libs-0:3.26.6-1.el9_8.3.ppc64le",
"product_id": "hplip-libs-0:3.26.6-1.el9_8.3.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/hplip-libs@3.26.6-1.el9_8.3?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "libsane-hpaio-0:3.26.6-1.el9_8.3.ppc64le",
"product": {
"name": "libsane-hpaio-0:3.26.6-1.el9_8.3.ppc64le",
"product_id": "libsane-hpaio-0:3.26.6-1.el9_8.3.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libsane-hpaio@3.26.6-1.el9_8.3?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "hplip-debugsource-0:3.26.6-1.el9_8.3.ppc64le",
"product": {
"name": "hplip-debugsource-0:3.26.6-1.el9_8.3.ppc64le",
"product_id": "hplip-debugsource-0:3.26.6-1.el9_8.3.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/hplip-debugsource@3.26.6-1.el9_8.3?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "hplip-debuginfo-0:3.26.6-1.el9_8.3.ppc64le",
"product": {
"name": "hplip-debuginfo-0:3.26.6-1.el9_8.3.ppc64le",
"product_id": "hplip-debuginfo-0:3.26.6-1.el9_8.3.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/hplip-debuginfo@3.26.6-1.el9_8.3?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.ppc64le",
"product": {
"name": "hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.ppc64le",
"product_id": "hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/hplip-libs-debuginfo@3.26.6-1.el9_8.3?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.ppc64le",
"product": {
"name": "libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.ppc64le",
"product_id": "libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libsane-hpaio-debuginfo@3.26.6-1.el9_8.3?arch=ppc64le"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "hplip-0:3.26.6-1.el9_8.3.x86_64",
"product": {
"name": "hplip-0:3.26.6-1.el9_8.3.x86_64",
"product_id": "hplip-0:3.26.6-1.el9_8.3.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/hplip@3.26.6-1.el9_8.3?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "hplip-common-0:3.26.6-1.el9_8.3.x86_64",
"product": {
"name": "hplip-common-0:3.26.6-1.el9_8.3.x86_64",
"product_id": "hplip-common-0:3.26.6-1.el9_8.3.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/hplip-common@3.26.6-1.el9_8.3?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "hplip-libs-0:3.26.6-1.el9_8.3.x86_64",
"product": {
"name": "hplip-libs-0:3.26.6-1.el9_8.3.x86_64",
"product_id": "hplip-libs-0:3.26.6-1.el9_8.3.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/hplip-libs@3.26.6-1.el9_8.3?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "libsane-hpaio-0:3.26.6-1.el9_8.3.x86_64",
"product": {
"name": "libsane-hpaio-0:3.26.6-1.el9_8.3.x86_64",
"product_id": "libsane-hpaio-0:3.26.6-1.el9_8.3.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libsane-hpaio@3.26.6-1.el9_8.3?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "hplip-debugsource-0:3.26.6-1.el9_8.3.x86_64",
"product": {
"name": "hplip-debugsource-0:3.26.6-1.el9_8.3.x86_64",
"product_id": "hplip-debugsource-0:3.26.6-1.el9_8.3.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/hplip-debugsource@3.26.6-1.el9_8.3?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "hplip-debuginfo-0:3.26.6-1.el9_8.3.x86_64",
"product": {
"name": "hplip-debuginfo-0:3.26.6-1.el9_8.3.x86_64",
"product_id": "hplip-debuginfo-0:3.26.6-1.el9_8.3.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/hplip-debuginfo@3.26.6-1.el9_8.3?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.x86_64",
"product": {
"name": "hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.x86_64",
"product_id": "hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/hplip-libs-debuginfo@3.26.6-1.el9_8.3?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.x86_64",
"product": {
"name": "libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.x86_64",
"product_id": "libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libsane-hpaio-debuginfo@3.26.6-1.el9_8.3?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "hplip-common-0:3.26.6-1.el9_8.3.i686",
"product": {
"name": "hplip-common-0:3.26.6-1.el9_8.3.i686",
"product_id": "hplip-common-0:3.26.6-1.el9_8.3.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/hplip-common@3.26.6-1.el9_8.3?arch=i686"
}
}
},
{
"category": "product_version",
"name": "hplip-libs-0:3.26.6-1.el9_8.3.i686",
"product": {
"name": "hplip-libs-0:3.26.6-1.el9_8.3.i686",
"product_id": "hplip-libs-0:3.26.6-1.el9_8.3.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/hplip-libs@3.26.6-1.el9_8.3?arch=i686"
}
}
},
{
"category": "product_version",
"name": "libsane-hpaio-0:3.26.6-1.el9_8.3.i686",
"product": {
"name": "libsane-hpaio-0:3.26.6-1.el9_8.3.i686",
"product_id": "libsane-hpaio-0:3.26.6-1.el9_8.3.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libsane-hpaio@3.26.6-1.el9_8.3?arch=i686"
}
}
},
{
"category": "product_version",
"name": "hplip-debugsource-0:3.26.6-1.el9_8.3.i686",
"product": {
"name": "hplip-debugsource-0:3.26.6-1.el9_8.3.i686",
"product_id": "hplip-debugsource-0:3.26.6-1.el9_8.3.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/hplip-debugsource@3.26.6-1.el9_8.3?arch=i686"
}
}
},
{
"category": "product_version",
"name": "hplip-debuginfo-0:3.26.6-1.el9_8.3.i686",
"product": {
"name": "hplip-debuginfo-0:3.26.6-1.el9_8.3.i686",
"product_id": "hplip-debuginfo-0:3.26.6-1.el9_8.3.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/hplip-debuginfo@3.26.6-1.el9_8.3?arch=i686"
}
}
},
{
"category": "product_version",
"name": "hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.i686",
"product": {
"name": "hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.i686",
"product_id": "hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/hplip-libs-debuginfo@3.26.6-1.el9_8.3?arch=i686"
}
}
},
{
"category": "product_version",
"name": "libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.i686",
"product": {
"name": "libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.i686",
"product_id": "libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libsane-hpaio-debuginfo@3.26.6-1.el9_8.3?arch=i686"
}
}
}
],
"category": "architecture",
"name": "i686"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "hplip-0:3.26.6-1.el9_8.3.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.aarch64"
},
"product_reference": "hplip-0:3.26.6-1.el9_8.3.aarch64",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "hplip-0:3.26.6-1.el9_8.3.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.ppc64le"
},
"product_reference": "hplip-0:3.26.6-1.el9_8.3.ppc64le",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "hplip-0:3.26.6-1.el9_8.3.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.s390x"
},
"product_reference": "hplip-0:3.26.6-1.el9_8.3.s390x",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "hplip-0:3.26.6-1.el9_8.3.src as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.src"
},
"product_reference": "hplip-0:3.26.6-1.el9_8.3.src",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "hplip-0:3.26.6-1.el9_8.3.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.x86_64"
},
"product_reference": "hplip-0:3.26.6-1.el9_8.3.x86_64",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "hplip-common-0:3.26.6-1.el9_8.3.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.aarch64"
},
"product_reference": "hplip-common-0:3.26.6-1.el9_8.3.aarch64",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "hplip-common-0:3.26.6-1.el9_8.3.i686 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.i686"
},
"product_reference": "hplip-common-0:3.26.6-1.el9_8.3.i686",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "hplip-common-0:3.26.6-1.el9_8.3.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.ppc64le"
},
"product_reference": "hplip-common-0:3.26.6-1.el9_8.3.ppc64le",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "hplip-common-0:3.26.6-1.el9_8.3.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.s390x"
},
"product_reference": "hplip-common-0:3.26.6-1.el9_8.3.s390x",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "hplip-common-0:3.26.6-1.el9_8.3.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.x86_64"
},
"product_reference": "hplip-common-0:3.26.6-1.el9_8.3.x86_64",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "hplip-debuginfo-0:3.26.6-1.el9_8.3.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.aarch64"
},
"product_reference": "hplip-debuginfo-0:3.26.6-1.el9_8.3.aarch64",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "hplip-debuginfo-0:3.26.6-1.el9_8.3.i686 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.i686"
},
"product_reference": "hplip-debuginfo-0:3.26.6-1.el9_8.3.i686",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "hplip-debuginfo-0:3.26.6-1.el9_8.3.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.ppc64le"
},
"product_reference": "hplip-debuginfo-0:3.26.6-1.el9_8.3.ppc64le",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "hplip-debuginfo-0:3.26.6-1.el9_8.3.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.s390x"
},
"product_reference": "hplip-debuginfo-0:3.26.6-1.el9_8.3.s390x",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "hplip-debuginfo-0:3.26.6-1.el9_8.3.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.x86_64"
},
"product_reference": "hplip-debuginfo-0:3.26.6-1.el9_8.3.x86_64",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "hplip-debugsource-0:3.26.6-1.el9_8.3.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.aarch64"
},
"product_reference": "hplip-debugsource-0:3.26.6-1.el9_8.3.aarch64",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "hplip-debugsource-0:3.26.6-1.el9_8.3.i686 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.i686"
},
"product_reference": "hplip-debugsource-0:3.26.6-1.el9_8.3.i686",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "hplip-debugsource-0:3.26.6-1.el9_8.3.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.ppc64le"
},
"product_reference": "hplip-debugsource-0:3.26.6-1.el9_8.3.ppc64le",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "hplip-debugsource-0:3.26.6-1.el9_8.3.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.s390x"
},
"product_reference": "hplip-debugsource-0:3.26.6-1.el9_8.3.s390x",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "hplip-debugsource-0:3.26.6-1.el9_8.3.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.x86_64"
},
"product_reference": "hplip-debugsource-0:3.26.6-1.el9_8.3.x86_64",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "hplip-libs-0:3.26.6-1.el9_8.3.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.aarch64"
},
"product_reference": "hplip-libs-0:3.26.6-1.el9_8.3.aarch64",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "hplip-libs-0:3.26.6-1.el9_8.3.i686 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.i686"
},
"product_reference": "hplip-libs-0:3.26.6-1.el9_8.3.i686",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "hplip-libs-0:3.26.6-1.el9_8.3.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.ppc64le"
},
"product_reference": "hplip-libs-0:3.26.6-1.el9_8.3.ppc64le",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "hplip-libs-0:3.26.6-1.el9_8.3.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.s390x"
},
"product_reference": "hplip-libs-0:3.26.6-1.el9_8.3.s390x",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "hplip-libs-0:3.26.6-1.el9_8.3.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.x86_64"
},
"product_reference": "hplip-libs-0:3.26.6-1.el9_8.3.x86_64",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.aarch64"
},
"product_reference": "hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.aarch64",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.i686 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.i686"
},
"product_reference": "hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.i686",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.ppc64le"
},
"product_reference": "hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.ppc64le",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.s390x"
},
"product_reference": "hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.s390x",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.x86_64"
},
"product_reference": "hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.x86_64",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libsane-hpaio-0:3.26.6-1.el9_8.3.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.aarch64"
},
"product_reference": "libsane-hpaio-0:3.26.6-1.el9_8.3.aarch64",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libsane-hpaio-0:3.26.6-1.el9_8.3.i686 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.i686"
},
"product_reference": "libsane-hpaio-0:3.26.6-1.el9_8.3.i686",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libsane-hpaio-0:3.26.6-1.el9_8.3.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.ppc64le"
},
"product_reference": "libsane-hpaio-0:3.26.6-1.el9_8.3.ppc64le",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libsane-hpaio-0:3.26.6-1.el9_8.3.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.s390x"
},
"product_reference": "libsane-hpaio-0:3.26.6-1.el9_8.3.s390x",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libsane-hpaio-0:3.26.6-1.el9_8.3.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.x86_64"
},
"product_reference": "libsane-hpaio-0:3.26.6-1.el9_8.3.x86_64",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.aarch64"
},
"product_reference": "libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.aarch64",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.i686 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.i686"
},
"product_reference": "libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.i686",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.ppc64le"
},
"product_reference": "libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.ppc64le",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.s390x"
},
"product_reference": "libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.s390x",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.x86_64"
},
"product_reference": "libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.x86_64",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2025-43023",
"cwe": {
"id": "CWE-347",
"name": "Improper Verification of Cryptographic Signature"
},
"discovery_date": "2025-07-28T18:01:00.592355+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.x86_64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2384011"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the HP Linux Imaging and Printing Software (HPLIP). This vulnerability is due to the use of a weak Digital Signature Algorithm (DSA) for code signing. A remote attacker could exploit this weakness to forge signatures, potentially leading to the execution of unauthorized code or tampering with the software. This could compromise the integrity and confidentiality of the affected system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "hplip: HP Linux Imaging and Printing Software - Use of DSA Key",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.src",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.x86_64"
],
"known_not_affected": [
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43023"
},
{
"category": "external",
"summary": "RHBZ#2384011",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2384011"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43023",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43023"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43023",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43023"
},
{
"category": "external",
"summary": "https://support.hp.com/us-en/document/ish_12804224-12804228-16/hpsbpi04033",
"url": "https://support.hp.com/us-en/document/ish_12804224-12804228-16/hpsbpi04033"
},
{
"category": "external",
"summary": "https://www.openwall.com/lists/oss-security/2025/08/22/4",
"url": "https://www.openwall.com/lists/oss-security/2025/08/22/4"
}
],
"release_date": "2025-07-28T17:46:46.398000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-14T16:11:09+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.src",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:82882"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.src",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.0,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:L",
"version": "3.1"
},
"products": [
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.src",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "hplip: HP Linux Imaging and Printing Software - Use of DSA Key"
},
{
"cve": "CVE-2026-91097",
"cwe": {
"id": "CWE-94",
"name": "Improper Control of Generation of Code (\u0027Code Injection\u0027)"
},
"discovery_date": "2026-09-16T18:51:27.689434+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.x86_64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2535607"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in HPLIP (HP Linux Imaging and Printing) software. Multiple vulnerabilities exist that could allow a remote attacker to execute arbitrary code, escalate privileges, cause a denial of service, disclose sensitive information, or modify files without authorization. These issues arise under specific, unspecified conditions.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "hplip: HPLIP: Multiple vulnerabilities enable remote code execution and privilege escalation",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.src",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.x86_64"
],
"known_not_affected": [
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-91097"
},
{
"category": "external",
"summary": "RHBZ#2535607",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2535607"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-91097",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-91097"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-91097",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91097"
},
{
"category": "external",
"summary": "https://support.hp.com/us-en/document/ish_15646959-15646984-16/hpsbpi04151",
"url": "https://support.hp.com/us-en/document/ish_15646959-15646984-16/hpsbpi04151"
}
],
"release_date": "2026-09-16T18:39:12.376000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-14T16:11:09+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.src",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:82882"
},
{
"category": "workaround",
"details": "To mitigate this issue, if HPLIP functionality is not required, consider removing the `hplip` package. This can be done using the following command:\n\n`sudo dnf remove hplip`\n\nRemoving this package will disable HP printer support and related utilities.",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.src",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.src",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "hplip: HPLIP: Multiple vulnerabilities enable remote code execution and privilege escalation"
},
{
"cve": "CVE-2026-91098",
"cwe": {
"id": "CWE-494",
"name": "Download of Code Without Integrity Check"
},
"discovery_date": "2026-09-16T18:51:24.859278+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.x86_64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2535603"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in HP Linux Imaging and Printing (HPLIP) software. Multiple vulnerabilities exist that could allow a remote attacker to achieve remote code execution, escalate privileges, cause a denial of service, disclose information, or modify files without authorization under certain conditions.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "hplip: HPLIP: Multiple vulnerabilities allow remote code execution and privilege escalation",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.src",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.x86_64"
],
"known_not_affected": [
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-91098"
},
{
"category": "external",
"summary": "RHBZ#2535603",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2535603"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-91098",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-91098"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-91098",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91098"
},
{
"category": "external",
"summary": "https://support.hp.com/us-en/document/ish_15646959-15646984-16/hpsbpi04151",
"url": "https://support.hp.com/us-en/document/ish_15646959-15646984-16/hpsbpi04151"
}
],
"release_date": "2026-09-16T18:43:03.461000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-14T16:11:09+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.src",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:82882"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.src",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.src",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "hplip: HPLIP: Multiple vulnerabilities allow remote code execution and privilege escalation"
},
{
"cve": "CVE-2026-91099",
"cwe": {
"id": "CWE-266",
"name": "Incorrect Privilege Assignment"
},
"discovery_date": "2026-09-16T18:51:31.299296+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.x86_64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2535600"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in HPLIP (HP Linux Imaging and Printing) software. Multiple vulnerabilities exist in several software components that could potentially allow a local attacker to achieve local code execution, escalate privileges, cause a denial of service (DoS), disclose sensitive information, or modify files without authorization under certain conditions.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "hplip: HPLIP: Multiple vulnerabilities enabling local code execution and privilege escalation",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.src",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.x86_64"
],
"known_not_affected": [
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-91099"
},
{
"category": "external",
"summary": "RHBZ#2535600",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2535600"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-91099",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-91099"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-91099",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91099"
},
{
"category": "external",
"summary": "https://support.hp.com/us-en/document/ish_15646959-15646984-16/hpsbpi04151",
"url": "https://support.hp.com/us-en/document/ish_15646959-15646984-16/hpsbpi04151"
}
],
"release_date": "2026-09-16T18:45:51.099000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-14T16:11:09+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.src",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:82882"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.src",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.src",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "hplip: HPLIP: Multiple vulnerabilities enabling local code execution and privilege escalation"
},
{
"cve": "CVE-2026-91100",
"cwe": {
"id": "CWE-266",
"name": "Incorrect Privilege Assignment"
},
"discovery_date": "2026-09-16T19:01:27.289552+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.x86_64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2535615"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in HP Linux Imaging and Printing (HPLIP) Software. Multiple vulnerabilities in several software components could allow a remote attacker to execute arbitrary code, escalate privileges, or cause a denial of service. Additionally, these flaws could lead to information disclosure or unauthorized file modification under certain conditions.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "hplip: HPLIP: Multiple vulnerabilities allow remote code execution, privilege escalation, and denial of service.",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.src",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.x86_64"
],
"known_not_affected": [
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-91100"
},
{
"category": "external",
"summary": "RHBZ#2535615",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2535615"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-91100",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-91100"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-91100",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91100"
},
{
"category": "external",
"summary": "https://support.hp.com/us-en/document/ish_15646959-15646984-16/hpsbpi04151",
"url": "https://support.hp.com/us-en/document/ish_15646959-15646984-16/hpsbpi04151"
}
],
"release_date": "2026-09-16T18:47:42.690000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-14T16:11:09+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.src",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:82882"
},
{
"category": "workaround",
"details": "If HP printer support is not required on the system, remove the HPLIP package to eliminate the attack surface. For Red Hat Enterprise Linux, use `sudo dnf remove hplip`. Removing this package will disable functionality for HP printers.",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.src",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:L",
"version": "3.1"
},
"products": [
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.src",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "hplip: HPLIP: Multiple vulnerabilities allow remote code execution, privilege escalation, and denial of service."
},
{
"cve": "CVE-2026-91101",
"cwe": {
"id": "CWE-266",
"name": "Incorrect Privilege Assignment"
},
"discovery_date": "2026-09-16T19:01:32.030231+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.x86_64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2535617"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in HPLIP (HP Linux Imaging and Printing) software. Multiple vulnerabilities within several components could allow a remote attacker to execute code on the system, gain elevated privileges, or access sensitive information. These issues could also lead to a denial of service, making the system unavailable, or unauthorized changes to files under certain conditions.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "hplip: HPLIP: Remote Code Execution and Privilege Escalation Vulnerabilities",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.src",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.x86_64"
],
"known_not_affected": [
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-91101"
},
{
"category": "external",
"summary": "RHBZ#2535617",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2535617"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-91101",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-91101"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-91101",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91101"
},
{
"category": "external",
"summary": "https://support.hp.com/us-en/document/ish_15646959-15646984-16/hpsbpi04151",
"url": "https://support.hp.com/us-en/document/ish_15646959-15646984-16/hpsbpi04151"
}
],
"release_date": "2026-09-16T18:49:00.876000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-14T16:11:09+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.src",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:82882"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, if HPLIP functionality is not required, consider removing the `hplip` package. This action will remove support for HP printers and may impact printing capabilities. Use the system\u0027s package manager to perform this operation. For example, on Red Hat Enterprise Linux, execute `sudo dnf remove hplip`.",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.src",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "PHYSICAL",
"availabilityImpact": "HIGH",
"baseScore": 4.6,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.src",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "hplip: HPLIP: Remote Code Execution and Privilege Escalation Vulnerabilities"
},
{
"cve": "CVE-2026-91102",
"cwe": {
"id": "CWE-494",
"name": "Download of Code Without Integrity Check"
},
"discovery_date": "2026-09-16T19:02:03.779660+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.x86_64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2535622"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in HP Linux Imaging and Printing (HPLIP) software. Multiple vulnerabilities exist within several software components that could potentially allow an attacker to achieve remote code execution, escalate privileges, cause a denial of service, disclose information, or modify files without authorization under certain conditions.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "HPLIP: HPLIP: Multiple vulnerabilities could lead to remote code execution",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.src",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.x86_64"
],
"known_not_affected": [
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-91102"
},
{
"category": "external",
"summary": "RHBZ#2535622",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2535622"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-91102",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-91102"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-91102",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91102"
},
{
"category": "external",
"summary": "https://support.hp.com/us-en/document/ish_15646959-15646984-16/hpsbpi04151",
"url": "https://support.hp.com/us-en/document/ish_15646959-15646984-16/hpsbpi04151"
}
],
"release_date": "2026-09-16T18:50:55.872000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-14T16:11:09+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.src",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:82882"
},
{
"category": "workaround",
"details": "To reduce the attack surface, restrict network access to systems running HPLIP if network printing or remote management features are not actively used. Alternatively, if HPLIP functionality is not required, the `hplip` package can be removed.\nTo remove the package:\n`sudo dnf remove hplip`\nRemoving the package will impact printing capabilities for HP devices.",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.src",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.src",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "HPLIP: HPLIP: Multiple vulnerabilities could lead to remote code execution"
},
{
"cve": "CVE-2026-91103",
"cwe": {
"id": "CWE-266",
"name": "Incorrect Privilege Assignment"
},
"discovery_date": "2026-09-16T19:01:01.157775+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.x86_64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2535613"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in HPLIP (HP Linux Imaging and Printing) software. This issue encompasses multiple vulnerabilities across several components, potentially allowing an attacker to achieve remote code execution, elevate their privileges, or cause a denial of service. Additionally, these flaws could lead to information disclosure or unauthorized file modification under certain conditions.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "hplip: HPLIP: Multiple vulnerabilities leading to remote code execution, privilege escalation, and denial of service",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.src",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.x86_64"
],
"known_not_affected": [
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-91103"
},
{
"category": "external",
"summary": "RHBZ#2535613",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2535613"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-91103",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-91103"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-91103",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91103"
},
{
"category": "external",
"summary": "https://support.hp.com/us-en/document/ish_15646959-15646984-16/hpsbpi04151",
"url": "https://support.hp.com/us-en/document/ish_15646959-15646984-16/hpsbpi04151"
}
],
"release_date": "2026-09-16T18:52:28.148000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-14T16:11:09+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.src",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:82882"
},
{
"category": "workaround",
"details": "HPLIP is a collection of drivers for HP printers. If HP printers are not in use, the `hplip` package can be removed to eliminate the attack surface.\n\nTo remove the package:\n`sudo dnf remove hplip`\n\nThis action may affect printing functionality for HP devices.",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.src",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.src",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "hplip: HPLIP: Multiple vulnerabilities leading to remote code execution, privilege escalation, and denial of service"
},
{
"cve": "CVE-2026-91104",
"cwe": {
"id": "CWE-122",
"name": "Heap-based Buffer Overflow"
},
"discovery_date": "2026-09-16T19:01:17.979913+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.x86_64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2535618"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in HPLIP. A heap-based buffer overflow could potentially allow an attacker to achieve code execution, escalate privileges, cause a denial of service, disclose sensitive information, or perform unauthorized file modifications under certain conditions.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "hplip: heap-based buffer overflow can lead to remote code execution",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability allows an unauthenticated attacker to achieve arbitrary code execution and privilege escalation, among other security impacts.\n\nHPLIP provides printer drivers and tools for managing HP devices. The client tools are not exposed to the network. Printer, scanner, and fax drivers are used by CUPS (once configured with a print queue). The driver binaries are executed within a restricted environment under the unprivileged \u0027lp\u0027 user. This limits exploitation to a local attacker and restricts code execution to the unprivileged \u0027lp\u0027 user.\n\nFor these reasons, this issue has been rated with an important severity.\n\nDefault Red Hat Enterprise Linux security features, including SELinux enforcement, Address Space Layout Randomization (ASLR) and NX (No-Execute) stack protection, significantly increase the difficulty of achieving arbitrary code execution, limiting the impact of this vulnerability.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.src",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.x86_64"
],
"known_not_affected": [
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-91104"
},
{
"category": "external",
"summary": "RHBZ#2535618",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2535618"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-91104",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-91104"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-91104",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91104"
},
{
"category": "external",
"summary": "https://support.hp.com/us-en/document/ish_15646959-15646984-16/hpsbpi04151",
"url": "https://support.hp.com/us-en/document/ish_15646959-15646984-16/hpsbpi04151"
}
],
"release_date": "2026-09-16T18:53:59.083000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-14T16:11:09+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.src",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:82882"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, consider removing the hplip package if its functionality is not required by using the command indicated below. Note this will remove HP printer support and related utilities from the system.\n\n~~~\nsudo dnf remove hplip\n~~~",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.src",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 8.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.src",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "hplip: heap-based buffer overflow can lead to remote code execution"
},
{
"cve": "CVE-2026-91105",
"cwe": {
"id": "CWE-266",
"name": "Incorrect Privilege Assignment"
},
"discovery_date": "2026-09-16T19:01:56.500111+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.x86_64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2535621"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in HPLIP. Multiple vulnerabilities in several software components could potentially allow a remote attacker to achieve remote code execution or privilege escalation under certain conditions, requiring user interaction. These flaws could also lead to denial of service, information disclosure, or unauthorized file modification.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "hplip: HPLIP: Remote code execution and privilege escalation vulnerabilities",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.src",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.x86_64"
],
"known_not_affected": [
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-91105"
},
{
"category": "external",
"summary": "RHBZ#2535621",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2535621"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-91105",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-91105"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-91105",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91105"
},
{
"category": "external",
"summary": "https://support.hp.com/us-en/document/ish_15646959-15646984-16/hpsbpi04151",
"url": "https://support.hp.com/us-en/document/ish_15646959-15646984-16/hpsbpi04151"
}
],
"release_date": "2026-09-16T18:54:53.213000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-14T16:11:09+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.src",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:82882"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.src",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.src",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "hplip: HPLIP: Remote code execution and privilege escalation vulnerabilities"
},
{
"cve": "CVE-2026-91106",
"cwe": {
"id": "CWE-122",
"name": "Heap-based Buffer Overflow"
},
"discovery_date": "2026-09-16T19:01:06.286412+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.x86_64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2535614"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in HPLIP. A heap-based buffer overflow could potentially allow an attacker to achieve code execution, escalate privileges, cause a denial of service, disclose sensitive information, or perform unauthorized file modifications under certain conditions.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "hplip: heap-based buffer overflow can lead to remote code execution",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability allows an unauthenticated attacker to achieve arbitrary code execution and privilege escalation, among other security impacts.\n\nHPLIP provides printer drivers and tools for managing HP devices. The client tools are not exposed to the network. Printer, scanner, and fax drivers are used by CUPS (once configured with a print queue). The driver binaries are executed within a restricted environment under the unprivileged \u0027lp\u0027 user. This limits exploitation to a local attacker and restricts code execution to the unprivileged \u0027lp\u0027 user.\n\nFor these reasons, this issue has been rated with an important severity.\n\nDefault Red Hat Enterprise Linux security features, including SELinux enforcement, Address Space Layout Randomization (ASLR) and NX (No-Execute) stack protection, significantly increase the difficulty of achieving arbitrary code execution, limiting the impact of this vulnerability.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.src",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.x86_64"
],
"known_not_affected": [
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-91106"
},
{
"category": "external",
"summary": "RHBZ#2535614",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2535614"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-91106",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-91106"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-91106",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91106"
},
{
"category": "external",
"summary": "https://support.hp.com/us-en/document/ish_15646959-15646984-16/hpsbpi04151",
"url": "https://support.hp.com/us-en/document/ish_15646959-15646984-16/hpsbpi04151"
}
],
"release_date": "2026-09-16T18:56:04.992000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-14T16:11:09+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.src",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:82882"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, consider removing the hplip package if its functionality is not required by using the command indicated below. Note this will remove HP printer support and related utilities from the system.\n\n~~~\nsudo dnf remove hplip\n~~~",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.src",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 8.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.src",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-common-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debuginfo-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-debugsource-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:hplip-libs-debuginfo-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-0:3.26.6-1.el9_8.3.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.i686",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:libsane-hpaio-debuginfo-0:3.26.6-1.el9_8.3.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "hplip: heap-based buffer overflow can lead to remote code execution"
}
]
}
Loading…
Loading…
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
Loading timeline…
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.