UBUNTU-CVE-2026-91100: Medium severity ubuntu/hplip vulnerability

Q: Does exploitation require prior privileges or user interaction?

The available severity vector indicates no privileges are required, exploitation has low attack complexity, and user interaction is required. It also identifies the attack vector as local.

Q: What level of impact is indicated by the severity assessment?

The vector indicates low confidentiality impact, high integrity impact, and low availability impact. No impact is indicated for subsequent-system confidentiality, integrity, or availability.

Published Sep 16, 2026

Updated

HP has identified and remediated multiple externally reported vulnerabilities within HPLIP. The findings affect several software components that could potentially enable remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification under certain conditions.

Affected Software

2 affected componentsFixes available

ubuntu/hplip<3.16.3+repack0-1ubuntu0.1~esm2

3.16.3+repack0-1ubuntu0.1~esm2

ubuntu/hplip<3.17.10+repack0-5ubuntu0.1~esm2

3.17.10+repack0-5ubuntu0.1~esm2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ubuntu/hplip to a version that resolves this vulnerability.
Fixed in 3.16.3+repack0-1ubuntu0.1~esm2
Upgrade
Upgrade ubuntu/hplip to a version that resolves this vulnerability.
Fixed in 3.17.10+repack0-5ubuntu0.1~esm2

Event History

Sep 16, 2026

CVE Published

via OSV·07:18 PM

Data Sourced

via OSV·07:18 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Does exploitation require prior privileges or user interaction?

The available severity vector indicates no privileges are required, exploitation has low attack complexity, and user interaction is required. It also identifies the attack vector as local.

What level of impact is indicated by the severity assessment?