Home / mailings

PDF

[USN-9037-1] HPLIP vulnerabilities

Posted on 10 November 2026
Ubuntu Security

==========================================================================Ubuntu Security Notice USN-9037-1
November 10, 2026

hplip vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 26.10
- Ubuntu 26.04 LTS
- Ubuntu 24.04 LTS
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS

Summary:

Several security issues were fixed in HPLIP.

Software Description:
- hplip: HP Linux Printing and Imaging System (HPLIP)

Details:

It was discovered that HPLIP did not properly handle certain data, which
could result in an out-of-bounds write. An attacker could possibly use this
issue to cause a denial of service, expose sensitive information or execute
arbitrary code. (CVE-2026-91097)

It was discovered that HPLIP did not properly handle certain input, which
could result in a heap-based buffer overflow. An attacker could possibly
use this issue to cause a denial of service, expose sensitive information
or execute arbitrary code. (CVE-2026-91098)

It was discovered that HPLIP created certain files with insecure
permissions. An attacker could possibly use this issue to expose or modify
sensitive information. (CVE-2026-91099)

It was discovered that HPLIP did not properly handle certain input while
issuing an OS command. An attacker could possibly use this issue to execute
arbitrary commands. This issue only affected Ubuntu 16.04 LTS and Ubuntu
18.04 LTS. (CVE-2026-91100)

It was discovered that HPLIP did not properly validate certain array
indices. An attacker could possibly use this issue to cause a denial of
service, expose sensitive information or execute arbitrary code.
(CVE-2026-91101)

It was discovered that HPLIP did not properly handle certain input while
issuing an OS command. An attacker could possibly use this issue to execute
arbitrary commands. (CVE-2026-91102)

It was discovered that HPLIP did not properly handle certain numeric
values, which could result in an integer underflow. An attacker could
possibly use this issue to cause a denial of service, expose sensitive
information or execute arbitrary code. (CVE-2026-91103)

It was discovered that HPLIP did not properly handle certain input, which
could result in a heap-based buffer overflow. An attacker could possibly
use this issue to cause a denial of service, expose sensitive information
or execute arbitrary code. (CVE-2026-91104, CVE-2026-91105, CVE-2026-91106)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 26.10
hplip 3.24.4+dfsg0-0ubuntu10.2

Ubuntu 26.04 LTS
hplip 3.24.4+dfsg0-0ubuntu8.3

Ubuntu 24.04 LTS
hplip 3.23.12+dfsg0-0ubuntu5.3

Ubuntu 22.04 LTS
hplip 3.21.12+dfsg0-1ubuntu0.3

Ubuntu 20.04 LTS
hplip 3.20.3+dfsg0-2ubuntu0.1+esm2
Available with Ubuntu Pro

Ubuntu 18.04 LTS
hplip 3.17.10+repack0-5ubuntu0.1~esm2
Available with Ubuntu Pro

Ubuntu 16.04 LTS
hplip 3.16.3+repack0-1ubuntu0.1~esm2
Available with Ubuntu Pro

In general, a standard system update will make all the necessary changes.

References:
https://ubuntu.com/security/notices/USN-9037-1
CVE-2026-91097, CVE-2026-91098, CVE-2026-91099, CVE-2026-91100,
CVE-2026-91101, CVE-2026-91102, CVE-2026-91103, CVE-2026-91104,
CVE-2026-91105, CVE-2026-91106

Package Information:
https://launchpad.net/ubuntu/+source/hplip/3.24.4+dfsg0-0ubuntu10.2
https://launchpad.net/ubuntu/+source/hplip/3.24.4+dfsg0-0ubuntu8.3
https://launchpad.net/ubuntu/+source/hplip/3.23.12+dfsg0-0ubuntu5.3
https://launchpad.net/ubuntu/+source/hplip/3.21.12+dfsg0-1ubuntu0.3

--===============7919508206205926292==Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature

 

TOP