UBUNTU-CVE-2026-91102: High severity ubuntu/hplip vulnerability
HP has identified and remediated multiple externally reported vulnerabilities within HPLIP. The findings affect several software components that could potentially enable remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification under certain conditions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/hplipto a version that resolves this vulnerability.Fixed in 3.16.3+repack0-1ubuntu0.1~esm2 - Upgrade
Upgrade
ubuntu/hplipto a version that resolves this vulnerability.Fixed in 3.17.10+repack0-5ubuntu0.1~esm2 - Upgrade
Upgrade
ubuntu/hplipto a version that resolves this vulnerability.Fixed in 3.20.3+dfsg0-2ubuntu0.1+esm2 - Upgrade
Upgrade
ubuntu/hplipto a version that resolves this vulnerability.Fixed in 3.21.12+dfsg0-1ubuntu0.3 - Upgrade
Upgrade
ubuntu/hplipto a version that resolves this vulnerability.Fixed in 3.23.12+dfsg0-0ubuntu5.3 - Upgrade
Upgrade
ubuntu/hplipto a version that resolves this vulnerability.Fixed in 3.24.4+dfsg0-0ubuntu10.2 - Upgrade
Upgrade
ubuntu/hplipto a version that resolves this vulnerability.Fixed in 3.24.4+dfsg0-0ubuntu8.3
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The supplied CVSS vector rates the attack vector as local and requires user interaction. It indicates no privileges are required before exploitation.
Should this be treated as an unauthenticated network attack?
Not based on the supplied CVSS vector, which is AV:L (local). The provided information does not identify a network-facing service, affected configuration, or specific exploitation path.
What is the potential security impact if exploitation succeeds?
The CVSS vector rates confidentiality, integrity, and availability impact as high. The advisory also states that the affected components could enable code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification under certain conditions.