HP Linux Imaging and Printing CVE-2026-8631

Patch available per vendor advisory - consult HP Security Bulletin HPSBPI04118 at https://support.hp.com/us-en/document/ish_14942099-14942126-16/hpsbpi04118 for the fixed HPLIP release and upgrade to that or later, then apply the corresponding distribution package update (apt/dnf/zypper) once your vendor rebuilds hplip. As compensating controls until patched, restrict CUPS to localhost by ensuring /etc/cups/cupsd.conf binds only to 127.0.0.1 and removes 'Listen *:631' (side effect: breaks remote print submission and IPP browsing), block inbound TCP/UDP 631 at the host or perimeter firewall for untrusted networks, disable CUPS print sharing (cupsctl --no-share-printers) on systems that do not need it, and on systems that do not use HP devices remove the hplip package entirely to eliminate the hpcups filter. Avoid accepting print jobs from untrusted sources and consider running CUPS under AppArmor/SELinux confinement where available to limit post-exploitation movement.