Skip to content
Fencer Vulns
critical 9.8

CVE-2026-91101 json

HP Linux Imaging and Printing (HPLIP) Software– Multiple Vulnerabilities

published 2026-09-16 53 d ago modified 2026-09-21 48 d ago also EUVD-2026-80999

cvss
9.8
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
1.0%
EPSS 1.0% chance of exploitation in 30 days, percentile 61%
public exploits
0
none known

Summary

HP has identified and remediated multiple externally reported vulnerabilities within HPLIP. The findings affect several software components that could potentially enable remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification under certain conditions.

Patch / fix

  • HP Inc. HP Linux Imaging and Printing Software (HPLIP) 3.26.6
  • hplip RHEL 9 3.26.6-1.el9_8.3
  • hplip-libs RHEL 9 3.26.6-1.el9_8.3
  • libsane-hpaio RHEL 9 3.26.6-1.el9_8.3
  • hplip RHEL 10.2 3.26.6-1.el10_2.3
  • hplip-libs RHEL 10.2 3.26.6-1.el10_2.3
  • libsane-hpaio RHEL 10.2 3.26.6-1.el10_2.3

red hat advisories RHSA-2026:82882RHSA-2026:82883

  • hplip SLES for SAP 15 SP5, SLES for SAP 15 SP4, SLES 15 SP5-LTSS +5 more 3.26.6-150400.3.25.1
  • hplip SLE Module for Desktop Applications 15 SP7, SLE Module for Basesystem 15 SP7 3.26.6-150700.4.11.1
  • hplip SLES for SAP 15 SP6, SLES 15 SP6-LTSS 3.26.6-150600.4.15.1
  • hplip SLES LTSS Extended Security 12 SP5, SLES 12 SP5-LTSS 3.26.6-3.14.2

suse advisories SUSE-SU-2026:4371-1SUSE-SU-2026:4364-1SUSE-SU-2026:4362-1SUSE-SU-2026:4335-1

  • hplip openSUSE Tumbleweed 3.26.6-1.1

opensuse advisories openSUSE-SU-2026:11858-1

  • hplip AlmaLinux 9 3.26.6-1.el9_8.3
  • hplip-libs AlmaLinux 9 3.26.6-1.el9_8.3
  • hplip-common AlmaLinux 9 3.26.6-1.el9_8.3
  • libsane-hpaio AlmaLinux 9 3.26.6-1.el9_8.3
  • hplip AlmaLinux 10 3.26.6-1.el10_2.3
  • hplip-libs AlmaLinux 10 3.26.6-1.el10_2.3
  • hplip-common AlmaLinux 10 3.26.6-1.el10_2.3
  • libsane-hpaio AlmaLinux 10 3.26.6-1.el10_2.3

almalinux advisories ALSA-2026:82882ALSA-2026:82883ALSA-2026:82295

  • hplip Rocky Linux 8 3.26.6-3.el8_10
  • hplip Rocky Linux 9 3.26.6-1.el9_8.3
  • hplip Rocky Linux 10 3.26.6-1.el10_2.3

rocky linux advisories RLSA-2026:82295RLSA-2026:82882RLSA-2026:82883

  • hplip Alpine 3.24 3.26.6-r0

alpine advisories ALPINE-CVE-2026-91101

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-91101 updated cvss 4.6

hplip: HPLIP: Remote Code Execution and Privilege Escalation Vulnerabilities

  • Red Hat Enterprise Linux 6 hpijs, hplip, hplip-gui, hplip-libs, hplip-common, libsane-hpaio
    affected: workaround, no fix planned “Out of support scope”
  • Red Hat Enterprise Linux 7 hpijs, hplip, hplip-gui, hplip-libs, hplip-common, libsane-hpaio
    affected: workaround, no fix available
  • Red Hat Enterprise Linux AppStream (v. 8) hplip 3.26.6-3.el8_10, hplip-gui 3.26.6-3.el8_10, hplip-libs 3.26.6-3.el8_10, libsane-hpaio 3.26.6-3.el8_10
    fixed: vendor fix RHSA-2026:82295
  • Red Hat Enterprise Linux AppStream (v. 9) hplip 3.26.6-1.el9_8.3, hplip-libs 3.26.6-1.el9_8.3, libsane-hpaio 3.26.6-1.el9_8.3
    fixed: vendor fix RHSA-2026:82882
  • Red Hat Enterprise Linux AppStream (v. 10) hplip 3.26.6-1.el10_2.3, hplip-libs 3.26.6-1.el10_2.3, libsane-hpaio 3.26.6-1.el10_2.3
    fixed: vendor fix RHSA-2026:82883
  • Red Hat Enterprise Linux AppStream (v. 8) hplip-common 3.26.6-3.el8_10 Red Hat Enterprise Linux AppStream (v. 9) hplip-common 3.26.6-1.el9_8.3 Red Hat Enterprise Linux AppStream (v. 10) hplip-common 3.26.6-1.el10_2.3
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
53 d ago

Exploit prediction

0.97% chance of exploitation in the next 30 days, higher than 61% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 4.0 5.1 CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CNA 4.0 5.1 CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

  • HP Inc. HP Linux Imaging and Printing Software (HPLIP)

Classification

Weakness
  • CWE-129 Improper Validation of Array Index

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.