UBUNTU-CVE-2026-91105: High severity ubuntu/hplip vulnerability
HP has identified and remediated multiple externally reported vulnerabilities within HPLIP. The findings affect several software components that could potentially enable remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification under certain conditions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/hplipto a version that resolves this vulnerability.Fixed in 3.16.3+repack0-1ubuntu0.1~esm2 - Upgrade
Upgrade
ubuntu/hplipto a version that resolves this vulnerability.Fixed in 3.17.10+repack0-5ubuntu0.1~esm2 - Upgrade
Upgrade
ubuntu/hplipto a version that resolves this vulnerability.Fixed in 3.20.3+dfsg0-2ubuntu0.1+esm2 - Upgrade
Upgrade
ubuntu/hplipto a version that resolves this vulnerability.Fixed in 3.21.12+dfsg0-1ubuntu0.3 - Upgrade
Upgrade
ubuntu/hplipto a version that resolves this vulnerability.Fixed in 3.23.12+dfsg0-0ubuntu5.3 - Upgrade
Upgrade
ubuntu/hplipto a version that resolves this vulnerability.Fixed in 3.24.4+dfsg0-0ubuntu10.2 - Upgrade
Upgrade
ubuntu/hplipto a version that resolves this vulnerability.Fixed in 3.24.4+dfsg0-0ubuntu8.3
Event History
Frequently Asked Questions
What level of access does an attacker need?
The provided severity vector indicates the issue is network-accessible, requires low attack complexity, and does not require privileges or user interaction. The specific vulnerable component and exploitation conditions are not identified in the available data.
Are systems using the default HPLIP configuration affected?
The available data does not state whether default HPLIP installations or configurations are affected. It only identifies Ubuntu's hplip package and notes that exploitation may occur under certain conditions.
What should be done if patching cannot happen immediately?
The provided data does not include vendor-recommended mitigations or workaround details. Because the issue is rated high severity and network-accessible, prioritize applying the Ubuntu-provided HPLIP security update when operationally possible.