UBUNTU-CVE-2026-91104: Critical severity ubuntu/hplip vulnerability
HP has identified and remediated multiple externally reported vulnerabilities within HPLIP. The findings affect several software components that could potentially enable remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification under certain conditions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/hplipto a version that resolves this vulnerability.Fixed in 3.16.3+repack0-1ubuntu0.1~esm2 - Upgrade
Upgrade
ubuntu/hplipto a version that resolves this vulnerability.Fixed in 3.17.10+repack0-5ubuntu0.1~esm2 - Upgrade
Upgrade
ubuntu/hplipto a version that resolves this vulnerability.Fixed in 3.20.3+dfsg0-2ubuntu0.1+esm2 - Upgrade
Upgrade
ubuntu/hplipto a version that resolves this vulnerability.Fixed in 3.21.12+dfsg0-1ubuntu0.3 - Upgrade
Upgrade
ubuntu/hplipto a version that resolves this vulnerability.Fixed in 3.23.12+dfsg0-0ubuntu5.3 - Upgrade
Upgrade
ubuntu/hplipto a version that resolves this vulnerability.Fixed in 3.24.4+dfsg0-0ubuntu10.2 - Upgrade
Upgrade
ubuntu/hplipto a version that resolves this vulnerability.Fixed in 3.24.4+dfsg0-0ubuntu8.3
Event History
Frequently Asked Questions
Does exploitation require authentication or user interaction?
The supplied CVSS vector indicates that exploitation can be performed over the network with low attack complexity, without privileges or user interaction.
What security impact is indicated if exploitation succeeds?
The CVSS vector indicates high impact to confidentiality, integrity, and availability. The advisory description also identifies potential remote code execution, privilege escalation, denial of service, information disclosure, and unauthorized file modification under certain conditions.
Can this record alone identify whether a specific HPLIP installation is affected?
No. The supplied information does not list affected or fixed HPLIP versions, package revisions, or configuration conditions, so version-level exposure cannot be determined from this record alone.