Skip to main content

HP Linux Imaging and Printing CVE-2026-8631

| EUVDEUVD-2026-31193 CRITICAL
Heap-based Buffer Overflow (CWE-122)
2026-05-20 hp-security-alert@hp.com GHSA-hcc9-h975-pvc2
RCE Buffer Overflow Heap Overflow HP Linux Imaging And Printing
9.3
CVSS 4.0 · Vendor: hp
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Identify Linux host exposing CUPS/IPP
  2. Delivery
    Craft malicious print job with overflow payload
  3. Exploit
    Submit job to hpcups filter
  4. Execution
    Trigger integer overflow and heap corruption
  5. Persist
    Hijack control flow in filter process
  6. Impact
    Execute arbitrary code, escalate from lp context

Vulnerability Assessment

Weakness
CWE
CWE-122
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK

1 technique across 1 tactic: Execution

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Exploitation requires the target host to have HPLIP installed with the hpcups CUPS filter present, and the attacker must be able to deliver crafted print data into the CUPS print pipeline so that hpcups parses it - in practice this means either reachability to the CUPS daemon over IPP (TCP 631) with print submission accepted from the attacker's network position, or the ability to submit a job through a shared/queued printer the victim host services. The CVSS 4.0 vector states AV:N/AC:L/PR:N/UI:N (network, low complexity, no privileges, no user interaction), so against a default-vulnerable HPLIP install with CUPS exposed and accepting jobs no further authentication or interaction is needed; however, default Linux desktop installs typically bind CUPS to localhost, which limits exploitation to local users or hosts where print sharing has been explicitly enabled. Limiting factors therefore include CUPS Listen configuration, firewall posture on port 631, whether printer sharing is enabled, and whether the lp user's filter process can be leveraged for meaningful privilege escalation on the target.
Impact

Signals point in tension and should be weighed carefully. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N, VC:H/VI:H/VA:H) yields a 9.3 critical rating implying remote, unauthenticated, low-complexity exploitation with full confidentiality, integrity and availability impact on the vulnerable component - yet hpcups is a CUPS filter normally invoked through a local print pipeline, so 'network' typically means via an exposed CUPS/IPP port (default 631) or a network-printable shared queue, which is not the default Linux desktop posture. EPSS data was not provided and the issue is not on CISA KEV, so there is no public exploitation probability signal. With no public exploit identified at time of analysis, real-world risk is highest for systems that intentionally share printers over the network or that accept print jobs from untrusted users; on isolated single-user workstations the practical attack surface is narrower than the score suggests. The AV:N assumption in the vector should be verified against the HP advisory before deprioritising - if hpcups is reachable only via local print submission, the effective vector is closer to AV:L.
Exploit ScenarioDerived

An attacker on a network that can reach a Linux host with HPLIP installed and CUPS accepting remote print submissions sends a malicious IPP print job containing crafted raster data engineered to trigger the integer overflow in hpcups during size computation. The undersized heap allocation is then overrun by the copy operation, corrupting heap structures to hijack control flow within the CUPS filter process and execute code in that security context, potentially as the lp user or escalating further depending on filter privileges. No public exploit identified at time of analysis, so this scenario is derived from the CWE-122 class and CVSS vector rather than a published POC.
Act Now Prioritize within 24-48h. Why: CRITICAL severity.
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – May 20, 2026

Heap-based integer overflow in the hpcups component of HP Linux Imaging and Printing Software (HPLIP) allows attackers to achieve arbitrary code execution and/or privilege escalation by submitting crafted print data. The CVSS 4.0 base score of 9.3 reflects network-reachable exploitation against the printing subsystem with no authentication or user interaction required, though no public exploit identified at time of analysis and the issue has not been added to CISA KEV.

RemediationAI

Patch available per vendor advisory - consult HP Security Bulletin HPSBPI04118 at https://support.hp.com/us-en/document/ish_14942099-14942126-16/hpsbpi04118 for the fixed HPLIP release and upgrade to that or later, then apply the corresponding distribution package update (apt/dnf/zypper) once your vendor rebuilds hplip. As compensating controls until patched, restrict CUPS to localhost by ensuring /etc/cups/cupsd.conf binds only to 127.0.0.1 and removes 'Listen *:631' (side effect: breaks remote print submission and IPP browsing), block inbound TCP/UDP 631 at the host or perimeter firewall for untrusted networks, disable CUPS print sharing (cupsctl --no-share-printers) on systems that do not need it, and on systems that do not use HP devices remove the hplip package entirely to eliminate the hpcups filter. Avoid accepting print jobs from untrusted sources and consider running CUPS under AppArmor/SELinux confinement where available to limit post-exploitation movement.

Affected VersionsENISA

HP Linux Imaging and Printing Software 0 <3.26.4

Affected Packages

euvd hp_linux_imaging_and_printing_software fix: 3.26.4

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

HPLIP is HP's open-source driver and management stack for HP inkjet and laser printers on Linux, widely bundled into mainstream distributions (Ubuntu, Fedora, Debian, RHEL) and frequently installed with elevated privileges to interact with CUPS, USB, and SNMP. The vulnerable component, hpcups, is the CUPS filter that converts print job data into the device-specific raster format consumed by HP printers. CWE-122 (heap-based buffer overflow) here originates from an integer overflow during size or offset calculations on attacker-controlled print data; the truncated arithmetic produces an undersized heap allocation that is then overrun when the actual data is copied in, corrupting adjacent heap metadata or function pointers within the CUPS filter process.

Know when Linux Imaging And Printing gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (hp) PRIMARY 9.3 CRITICAL
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE 9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat 9.8 HIGH

Primary rating from Vendor (hp).

CVSS VectorVendor: hp

Attack Vector
Network
Attack Complexity
Low
Attack Requirements
None
Privileges Required
None
User Interaction
None
Vulnerable system: Confidentiality
High
Vulnerable system: Integrity
High
Vulnerable system: Availability
High
Subsequent system: Confidentiality
None
Subsequent system: Integrity
None
Subsequent system: Availability
None

Lifecycle Timeline

1
Patch available
May 20, 2026 - 22:02 EUVD

DescriptionCVE.org

A potential security vulnerability has been identified in the HP Linux Imaging and Printing Software. This potential vulnerability may allow escalation of privileges and/or arbitrary code execution via an integer overflow in the hpcups processing path when handling crafted print data.

Executive ViewAI

Why It Matters

HP Linux Imaging and Printing Software (HPLIP) contains a critical remote code execution vulnerability in the hpcups component that allows unauthenticated network attackers to execute arbitrary code and escalate privileges on affected Linux systems. Organizations using HP printers or HPLIP on Linux infrastructure face immediate risk of printing system compromise and potential lateral movement into adjacent networks. This vulnerability requires urgent mitigation given the absence of a vendor patch and the ease of exploitation.

Business Impact: Severe
Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations include: Network segmentation isolating print servers from general-purpose networks; firewall rules restricting network access to HPLIP services; disabling or rate-limiting remote print protocols not essential for operations; principle of least privilege on print system access; comprehensive logging and real-time monitoring of print server activity; automated alerts for HP security bulletins related to HPLIP; evaluation of air-gapping critical print infrastructure.

Threat Intelligence Overview

EPSS Score
0.0%
Top 94% exploitable
Social Media
2
Sightings
Data Quality
7 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment Vendor CIRCL VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity CRITICAL
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
CRITICAL severity
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Out-of-Cycle
Exploitation
None
System Exposure· derived
Open
Automatable
Yes
Human Impact
Very High
Technical Impact
Total

Priority Score

46
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +46
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Heap Overflow HIGH

A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.

Remote Code Execution CRITICAL

Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.

More in Linux Imaging And Printing

View all
CVE-2026-8632 HIGH
8.5 May 20

Local privilege escalation in HP Linux Imaging and Printing Software (HPLIP) allows authenticated low-privileged users t
CVE-2015-0839 HIGH
8.1 Aug 02

The hp-plugin utility in HP Linux Imaging and Printing (HPLIP) makes it easier for man-in-the-middle attackers to execut

Same weakness CWE-122 – Heap-based Buffer Overflow

View all
CVE-2023-4911 HIGH POC
7.8
CVE-2023-27997 CRITICAL
9.8
CVE-2026-94127 CRITICAL POC
9.3
CVE-2025-25249 CRITICAL POC
9.8
CVE-2026-85880 HIGH POC
7.8
CVE-2025-24985 HIGH POC
7.8
CVE-2026-53362 HIGH POC
7.8
CVE-2025-21418 HIGH
7.8

Same technique RCE

View all
CVE-2021-44228 CRITICAL POC
10.0
CVE-2017-7269 CRITICAL POC
9.8
CVE-2022-47966 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2023-3519 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2016-4117 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: Critical
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise Module for Basesystem 15 SP7 Fixed
SUSE Linux Enterprise Module for Desktop Applications 15 SP7 Fixed
SUSE Linux Enterprise Server 15 SP7 Fixed

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-8631 ADVISORY https://ubuntu.com/security/notices/USN-8483-1 ADVISORY https://vuldb.com/vuln/364962 REF https://access.redhat.com/errata/RHSA-2026:26228 REF https://access.redhat.com/errata/RHSA-2026:26297 REF https://access.redhat.com/errata/RHSA-2026:26335 REF https://access.redhat.com/errata/RHSA-2026:48171 REF https://access.redhat.com/errata/RHSA-2026:48586 REF https://access.redhat.com/errata/RHSA-2026:48603 REF https://access.redhat.com/errata/RHSA-2026:48606 REF https://access.redhat.com/errata/RHSA-2026:48959 REF https://access.redhat.com/errata/RHSA-2026:48960 REF https://access.redhat.com/errata/RHSA-2026:48961 REF https://access.redhat.com/security/cve/CVE-2026-8631 REF https://bugzilla.redhat.com/show_bug.cgi?id=2480300 REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-8631.json REF https://support.hp.com/us-en/document/ish_14942099-14942126-16/hpsbpi04118

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy