Every CVE Search/ Get API key

CVE-2026-91097

HP Linux Imaging and Printing (HPLIP) Software– Multiple Vulnerabilities

7.0 HighPublic exploitFix available

CVE-2026-91097 is a high vulnerability (CVSS 7.0) in Hp Linux Imaging And Printing, published September 16, 2026. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 1.01%, the 63rd percentile. Fixed in hplip 3.26.6-r0.

HP has identified and remediated multiple externally reported vulnerabilities within HPLIP. The findings affect several software components that could potentially enable remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification under certain conditions.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Active

What an attacker can affect

Confidentiality
Low
Integrity
High
Availability
Low

Exploit likelihood

1.01%Up 0.3 points since Sep 17, 2026
90%50%10%1%

What each source reports

CVE List Score used 7.0

HP Linux Imaging and Printing (HPLIP) Software– Multiple Vulnerabilities

HP has identified and remediated multiple externally reported vulnerabilities within HPLIP. The findings affect several software components that could potentially enable remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification under certain conditions.

Record
CVE-2026-91097
CVSS 4.0
7.0 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N
Weakness
CWE-787
Updated
2026-11-02
EUVDEUVD-2026-80988 7.0

HP has identified and remediated multiple externally reported vulnerabilities within HPLIP. The findings affect several software components that could potentially enable remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification under certain conditions.

Record
EUVD-2026-80988
CVSS 4.0
7.0 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-52x8-q22p-3rrf 7.0

HP has identified and remediated multiple externally reported vulnerabilities within HPLIP. The...

HP has identified and remediated multiple externally reported vulnerabilities within HPLIP. The findings affect several software components that could potentially enable remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification under certain conditions.

Record
GHSA-52x8-q22p-3rrf
CVSS 4.0
7.0 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-787
Updated
2026-11-02
NVD 7.0

HP has identified and remediated multiple externally reported vulnerabilities within HPLIP. The findings affect several software components that could potentially enable remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification under certain conditions.

Record
CVE-2026-91097
CVSS 4.0
7.0 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-787
Updated
2026-11-02
OSVALPINE-CVE-2026-91097 9.8

HP has identified and remediated multiple externally reported vulnerabilities within HPLIP. The findings affect several software components that could potentially enable remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification under certain conditions.

Record
ALPINE-CVE-2026-91097
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-03
OSVDEBIAN-CVE-2026-91097 9.8

HP has identified and remediated multiple externally reported vulnerabilities within HPLIP. The findings affect several software components that could potentially enable remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification under certain conditions.

Record
DEBIAN-CVE-2026-91097
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 16 moreShow less
OSVRHSA-2026:82882 8.8

Red Hat Security Advisory: hplip security, bug fix, and enhancement update

Record
RHSA-2026:82882
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:82883 8.8

Red Hat Security Advisory: hplip security, bug fix, and enhancement update

Record
RHSA-2026:82883
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRLSA-2026:82295 8.8

Important: hplip security update

The hplip packages contain the Hewlett-Packard Linux Imaging and Printing Project (HPLIP), which provides drivers for Hewlett-Packard printers and multi-function peripherals.

Security Fix(es):

  • hplip: potential memory buffer overflow (CVE-2020-6923)

  • hplip: HP Linux Imaging and Printing Software - Use of DSA Key (CVE-2025-43023)

  • hplip: HPLIP: Multiple vulnerabilities enabling local code execution and privilege escalation (CVE-2026-91099)

  • hplip: HPLIP: Multiple vulnerabilities allow remote code execution and privilege escalation (CVE-2026-91098)

  • hplip: HPLIP: Multiple vulnerabilities enable remote code execution and privilege escalation (CVE-2026-91097)

  • hplip: HPLIP: Multiple vulnerabilities leading to remote code execution, privilege escalation, and denial of service (CVE-2026-91103)

  • hplip: heap-based buffer overflow can lead to remote code execution (CVE-2026-91106)

  • hplip: HPLIP: Multiple vulnerabilities allow remote code execution, privilege escalation, and denial of service. (CVE-2026-91100)

  • hplip: HPLIP: Remote Code Execution and Privilege Escalation Vulnerabilities (CVE-2026-91101)

  • hplip: heap-based buffer overflow can lead to remote code execution (CVE-2026-91104)

  • hplip: HPLIP: Remote code execution and privilege escalation vulnerabilities (CVE-2026-91105)

  • HPLIP: HPLIP: Multiple vulnerabilities could lead to remote code execution (CVE-2026-91102)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:82295
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRLSA-2026:82882 8.8

Important: hplip security, bug fix, and enhancement update

The hplip packages contain the Hewlett-Packard Linux Imaging and Printing Project (HPLIP), which provides drivers for Hewlett-Packard printers and multi-function peripherals.

Security Fix(es):

  • hplip: HP Linux Imaging and Printing Software - Use of DSA Key (CVE-2025-43023)

  • hplip: HPLIP: Multiple vulnerabilities enabling local code execution and privilege escalation (CVE-2026-91099)

  • hplip: HPLIP: Multiple vulnerabilities allow remote code execution and privilege escalation (CVE-2026-91098)

  • hplip: HPLIP: Multiple vulnerabilities enable remote code execution and privilege escalation (CVE-2026-91097)

  • hplip: HPLIP: Multiple vulnerabilities leading to remote code execution, privilege escalation, and denial of service (CVE-2026-91103)

  • hplip: heap-based buffer overflow can lead to remote code execution (CVE-2026-91106)

  • hplip: HPLIP: Multiple vulnerabilities allow remote code execution, privilege escalation, and denial of service. (CVE-2026-91100)

  • hplip: HPLIP: Remote Code Execution and Privilege Escalation Vulnerabilities (CVE-2026-91101)

  • hplip: heap-based buffer overflow can lead to remote code execution (CVE-2026-91104)

  • hplip: HPLIP: Remote code execution and privilege escalation vulnerabilities (CVE-2026-91105)

  • HPLIP: HPLIP: Multiple vulnerabilities could lead to remote code execution (CVE-2026-91102)

Bug Fix(es) and Enhancement(s):

  • [IMAGE-MODE] missing /var/lib/hp on image-mode (JIRA:Rocky Linux-257310)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:82882
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRLSA-2026:82883 8.8

Important: hplip security, bug fix, and enhancement update

The hplip packages contain the Hewlett-Packard Linux Imaging and Printing Project (HPLIP), which provides drivers for Hewlett-Packard printers and multi-function peripherals.

Security Fix(es):

  • hplip: HP Linux Imaging and Printing Software - Use of DSA Key (CVE-2025-43023)

  • hplip: HPLIP: Multiple vulnerabilities enabling local code execution and privilege escalation (CVE-2026-91099)

  • hplip: HPLIP: Multiple vulnerabilities allow remote code execution and privilege escalation (CVE-2026-91098)

  • hplip: HPLIP: Multiple vulnerabilities enable remote code execution and privilege escalation (CVE-2026-91097)

  • hplip: HPLIP: Multiple vulnerabilities leading to remote code execution, privilege escalation, and denial of service (CVE-2026-91103)

  • hplip: heap-based buffer overflow can lead to remote code execution (CVE-2026-91106)

  • hplip: HPLIP: Multiple vulnerabilities allow remote code execution, privilege escalation, and denial of service. (CVE-2026-91100)

  • hplip: HPLIP: Remote Code Execution and Privilege Escalation Vulnerabilities (CVE-2026-91101)

  • hplip: heap-based buffer overflow can lead to remote code execution (CVE-2026-91104)

  • hplip: HPLIP: Remote code execution and privilege escalation vulnerabilities (CVE-2026-91105)

  • HPLIP: HPLIP: Multiple vulnerabilities could lead to remote code execution (CVE-2026-91102)

Bug Fix(es) and Enhancement(s):

  • [IMAGE-MODE] missing /var/lib/hp on image-mode [rhel-10] (JIRA:Rocky Linux-266547)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:82883
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-91097 7.0

HP has identified and remediated multiple externally reported vulnerabilities within HPLIP. The findings affect several software components that could potentially enable remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification under certain conditions.

Record
UBUNTU-CVE-2026-91097
CVSS 4.0
7.0 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVALSA-2026:82295 No score

Important: hplip security update

The hplip packages contain the Hewlett-Packard Linux Imaging and Printing Project (HPLIP), which provides drivers for Hewlett-Packard printers and multi-function peripherals.

Security Fix(es):

  • hplip: potential memory buffer overflow (CVE-2020-6923)
  • hplip: HP Linux Imaging and Printing Software - Use of DSA Key (CVE-2025-43023)
  • hplip: HPLIP: Multiple vulnerabilities enabling local code execution and privilege escalation (CVE-2026-91099)
  • hplip: HPLIP: Multiple vulnerabilities allow remote code execution and privilege escalation (CVE-2026-91098)
  • hplip: HPLIP: Multiple vulnerabilities enable remote code execution and privilege escalation (CVE-2026-91097)
  • hplip: HPLIP: Multiple vulnerabilities leading to remote code execution, privilege escalation, and denial of service (CVE-2026-91103)
  • hplip: heap-based buffer overflow can lead to remote code execution (CVE-2026-91106)
  • hplip: HPLIP: Multiple vulnerabilities allow remote code execution, privilege escalation, and denial of service. (CVE-2026-91100)
  • hplip: HPLIP: Remote Code Execution and Privilege Escalation Vulnerabilities (CVE-2026-91101)
  • hplip: heap-based buffer overflow can lead to remote code execution (CVE-2026-91104)
  • hplip: HPLIP: Remote code execution and privilege escalation vulnerabilities (CVE-2026-91105)
  • HPLIP: HPLIP: Multiple vulnerabilities could lead to remote code execution (CVE-2026-91102)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:82295
Updated
2026-11-02
OSVALSA-2026:82882 No score

Important: hplip security, bug fix, and enhancement update

The hplip packages contain the Hewlett-Packard Linux Imaging and Printing Project (HPLIP), which provides drivers for Hewlett-Packard printers and multi-function peripherals.

Security Fix(es):

  • hplip: HP Linux Imaging and Printing Software - Use of DSA Key (CVE-2025-43023)
  • hplip: HPLIP: Multiple vulnerabilities enabling local code execution and privilege escalation (CVE-2026-91099)
  • hplip: HPLIP: Multiple vulnerabilities allow remote code execution and privilege escalation (CVE-2026-91098)
  • hplip: HPLIP: Multiple vulnerabilities enable remote code execution and privilege escalation (CVE-2026-91097)
  • hplip: HPLIP: Multiple vulnerabilities leading to remote code execution, privilege escalation, and denial of service (CVE-2026-91103)
  • hplip: heap-based buffer overflow can lead to remote code execution (CVE-2026-91106)
  • hplip: HPLIP: Multiple vulnerabilities allow remote code execution, privilege escalation, and denial of service. (CVE-2026-91100)
  • hplip: HPLIP: Remote Code Execution and Privilege Escalation Vulnerabilities (CVE-2026-91101)
  • hplip: heap-based buffer overflow can lead to remote code execution (CVE-2026-91104)
  • hplip: HPLIP: Remote code execution and privilege escalation vulnerabilities (CVE-2026-91105)
  • HPLIP: HPLIP: Multiple vulnerabilities could lead to remote code execution (CVE-2026-91102)

Bug Fix(es) and Enhancement(s):

  • [IMAGE-MODE] missing /var/lib/hp on image-mode (JIRA:AlmaLinux-257310)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:82882
Updated
2026-11-02
OSVALSA-2026:82883 No score

Important: hplip security, bug fix, and enhancement update

The hplip packages contain the Hewlett-Packard Linux Imaging and Printing Project (HPLIP), which provides drivers for Hewlett-Packard printers and multi-function peripherals.

Security Fix(es):

  • hplip: HP Linux Imaging and Printing Software - Use of DSA Key (CVE-2025-43023)
  • hplip: HPLIP: Multiple vulnerabilities enabling local code execution and privilege escalation (CVE-2026-91099)
  • hplip: HPLIP: Multiple vulnerabilities allow remote code execution and privilege escalation (CVE-2026-91098)
  • hplip: HPLIP: Multiple vulnerabilities enable remote code execution and privilege escalation (CVE-2026-91097)
  • hplip: HPLIP: Multiple vulnerabilities leading to remote code execution, privilege escalation, and denial of service (CVE-2026-91103)
  • hplip: heap-based buffer overflow can lead to remote code execution (CVE-2026-91106)
  • hplip: HPLIP: Multiple vulnerabilities allow remote code execution, privilege escalation, and denial of service. (CVE-2026-91100)
  • hplip: HPLIP: Remote Code Execution and Privilege Escalation Vulnerabilities (CVE-2026-91101)
  • hplip: heap-based buffer overflow can lead to remote code execution (CVE-2026-91104)
  • hplip: HPLIP: Remote code execution and privilege escalation vulnerabilities (CVE-2026-91105)
  • HPLIP: HPLIP: Multiple vulnerabilities could lead to remote code execution (CVE-2026-91102)

Bug Fix(es) and Enhancement(s):

  • [IMAGE-MODE] missing /var/lib/hp on image-mode [almalinux-10] (JIRA:AlmaLinux-266547)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:82883
Updated
2026-11-02
OSVCLSA-2026-1792490933 No score

hplip: Fix of 7 CVEs

  • CVE-2026-91097: bound LEDM HTTP response copies in http_read() of the SANE hpaio backend (stack buffer overflow) (backport of HPLIP 3.26.6 and RHEL c9s)
  • CVE-2026-91098: bound device-supplied data in the LEDM scan backend (resolution lists, job Location header, BinaryURL and chunk size parsing) (heap/stack buffer overflow) (backport of HPLIP 3.26.6 and RHEL c9s)
  • CVE-2026-91101: validate device-supplied channel ids in libhpmud MLC/DOT4 (out-of-bounds read/write) (backport of HPLIP 3.26.6)
  • CVE-2026-91103: reject MFPDTF blocks shorter than their header in the SANE hpaio backend (integer underflow) (backport of HPLIP 3.26.6)
  • CVE-2026-91104: size the hpcups raster line buffer from each page header (heap buffer overflow) (backport of HPLIP 3.26.6)
  • CVE-2026-91105: fix buffer overflows in the hpps PostScript filter (backport of HPLIP 3.26.6)
  • CVE-2026-91106: fix integer overflow in the hpcups/hpijs halftoner output width (heap buffer overflow) (backport of HPLIP 3.26.6 and RHEL c9s)
Record
CLSA-2026-1792490933
Updated
2026-11-02
OSVCLSA-2026-1792704664 No score

hplip: Fix of 6 CVEs

  • CVE-2026-91097: bound LEDM HTTP response copies to the caller's buffer in http_read() of the SANE hpaio backend (backport of HPLIP 3.26.6)
  • CVE-2026-91098: bound device-supplied data in the LEDM scan backend (parse_scan_elements(), bb_start_scan(), get_size()) (backport of HPLIP 3.26.6 and RHEL 9)
  • CVE-2026-91101: validate device-supplied channel ids and data lengths in libhpmud MLC/DOT4 reverse-command handling (backport of HPLIP 3.26.6)
  • CVE-2026-91103: reject MFPDTF blocks shorter than their header in MfpdtfReadService() of the SANE hpaio backend (backport of HPLIP 3.26.6)
  • CVE-2026-91104: size the hpcups printer buffer from each page header in HPCupsFilter::processRasterData() (backport of HPLIP 3.26.6)
  • CVE-2026-91105: fix buffer overflows in the hpps PostScript filter (backport of HPLIP 3.26.6 and RHEL 9)
Record
CLSA-2026-1792704664
Updated
2026-11-02
OSVopenSUSE-SU-2026:11858-1 No score

hplip-3.26.6-1.1 on GA media

These are all security issues fixed in the hplip-3.26.6-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:11858-1
Updated
2026-11-02
OSVSUSE-SU-2026:4335-1 No score

Security update for hplip

This update for hplip fixes the following issues:

  • CVE-2026-91097: high severity issue - multiple vulnerabilities enable remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification under certain conditions (bsc#1281303).
  • CVE-2026-91098: high severity issue - multiple vulnerabilities enable remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification under certain conditions (bsc#1281304).
  • CVE-2026-91099: medium severity issue - multiple vulnerabilities enable remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification under certain conditions (bsc#1281305).
  • CVE-2026-91100: medium severity issue - multiple vulnerabilities enable remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification under certain conditions (bsc#1281306).
  • CVE-2026-91101: medium severity issue - multiple vulnerabilities enable remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification under certain conditions (bsc#1281307).
  • CVE-2026-91102: high severity issue - multiple vulnerabilities enable remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification under certain conditions (bsc#1281308).
  • CVE-2026-91103: medium severity issue - multiple vulnerabilities enable remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification under certain conditions (bsc#1281309).
  • CVE-2026-91104: critical severity issue - multiple vulnerabilities enable remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification under certain conditions (bsc#1281313).
  • CVE-2026-91105: high severity issue - multiple vulnerabilities enable remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification under certain conditions (bsc#1281310).
  • CVE-2026-91106: critical severity issue - multiple vulnerabilities enable remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification under certain conditions (bsc#1281314 bsc#1282051).

Changes for hplip:

  • Fix download of propietary plugin for 3.26.6
  • Update to HPLIP 3.26.6
  • Add support for the following new printers:
  • HP ScanJet Enterprise Flow N9000 sn1
  • HP ScanJet Enterprise Flow 9000 s1
  • HP ScanJet Pro 4200 s1
  • HP LaserJet Pro 4006dn printer
  • HP LaserJet Pro 4006dw printer
  • HP LaserJet Pro 4006n printer
  • HP LaserJet Pro 4002d printer
  • HP LaserJet Pro 4007dw printer
  • HP LaserJet Pro 4007n printer
  • HP LaserJet Pro 4008d
  • HP LaserJet Pro 4008dn
  • HP LaserJet Pro 4008dw
  • HP LaserJet Pro MFP 4112dw printer
  • HP LaserJet Pro MFP 4112fdn printer
  • HP LaserJet Pro MFP 4112fdw printer
  • HP LaserJet Pro MFP 4113dw printer
  • HP LaserJet Pro MFP 4113dwg printer
  • HP LaserJet Pro MFP 4113fdn printer
  • HP LaserJet Pro MFP 4113fdng printer
  • HP LaserJet Pro MFP 4113fdw printer
  • HP LaserJet Pro MFP 4113fdwg printer
  • HP LaserJet Pro MFP 4114dw
  • HP LaserJet Pro MFP 4114fdn
  • HP LaserJet Pro MFP 4114fdw
Record
SUSE-SU-2026:4335-1
Updated
2026-11-02
OSVSUSE-SU-2026:4362-1 No score

Security update for hplip

This update for hplip fixes the following issues:

  • CVE-2026-91097: high severity issue - multiple vulnerabilities enable remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification under certain conditions (bsc#1281303).
  • CVE-2026-91098: high severity issue - multiple vulnerabilities enable remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification under certain conditions (bsc#1281304).
  • CVE-2026-91099: medium severity issue - multiple vulnerabilities enable remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification under certain conditions (bsc#1281305).
  • CVE-2026-91100: medium severity issue - multiple vulnerabilities enable remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification under certain conditions (bsc#1281306).
  • CVE-2026-91101: medium severity issue - multiple vulnerabilities enable remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification under certain conditions (bsc#1281307).
  • CVE-2026-91102: high severity issue - multiple vulnerabilities enable remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification under certain conditions (bsc#1281308).
  • CVE-2026-91103: medium severity issue - multiple vulnerabilities enable remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification under certain conditions (bsc#1281309).
  • CVE-2026-91104: critical severity issue - multiple vulnerabilities enable remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification under certain conditions (bsc#1281313).
  • CVE-2026-91105: high severity issue - multiple vulnerabilities enable remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification under certain conditions (bsc#1281310).
  • CVE-2026-91106: critical severity issue - multiple vulnerabilities enable remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification under certain conditions (bsc#1281314 bsc#1282051).

Changes for hplip:

  • Fix download of propietary plugin for 3.26.6
  • Update to HPLIP 3.26.6
  • Add support for the following new printers:
  • HP ScanJet Enterprise Flow N9000 sn1
  • HP ScanJet Enterprise Flow 9000 s1
  • HP ScanJet Pro 4200 s1
  • HP LaserJet Pro 4006dn printer
  • HP LaserJet Pro 4006dw printer
  • HP LaserJet Pro 4006n printer
  • HP LaserJet Pro 4002d printer
  • HP LaserJet Pro 4007dw printer
  • HP LaserJet Pro 4007n printer
  • HP LaserJet Pro 4008d
  • HP LaserJet Pro 4008dn
  • HP LaserJet Pro 4008dw
  • HP LaserJet Pro MFP 4112dw printer
  • HP LaserJet Pro MFP 4112fdn printer
  • HP LaserJet Pro MFP 4112fdw printer
  • HP LaserJet Pro MFP 4113dw printer
  • HP LaserJet Pro MFP 4113dwg printer
  • HP LaserJet Pro MFP 4113fdn printer
  • HP LaserJet Pro MFP 4113fdng printer
  • HP LaserJet Pro MFP 4113fdw printer
  • HP LaserJet Pro MFP 4113fdwg printer
  • HP LaserJet Pro MFP 4114dw
  • HP LaserJet Pro MFP 4114fdn
  • HP LaserJet Pro MFP 4114fdw
Record
SUSE-SU-2026:4362-1
Updated
2026-11-02
OSVSUSE-SU-2026:4364-1 No score

Security update for hplip

This update for hplip fixes the following issues:

  • CVE-2026-91097: high severity issue - multiple vulnerabilities enable remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification under certain conditions (bsc#1281303).
  • CVE-2026-91098: high severity issue - multiple vulnerabilities enable remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification under certain conditions (bsc#1281304).
  • CVE-2026-91099: medium severity issue - multiple vulnerabilities enable remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification under certain conditions (bsc#1281305).
  • CVE-2026-91100: medium severity issue - multiple vulnerabilities enable remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification under certain conditions (bsc#1281306).
  • CVE-2026-91101: medium severity issue - multiple vulnerabilities enable remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification under certain conditions (bsc#1281307).
  • CVE-2026-91102: high severity issue - multiple vulnerabilities enable remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification under certain conditions (bsc#1281308).
  • CVE-2026-91103: medium severity issue - multiple vulnerabilities enable remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification under certain conditions (bsc#1281309).
  • CVE-2026-91104: critical severity issue - multiple vulnerabilities enable remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification under certain conditions (bsc#1281313).
  • CVE-2026-91105: high severity issue - multiple vulnerabilities enable remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification under certain conditions (bsc#1281310).
  • CVE-2026-91106: critical severity issue - multiple vulnerabilities enable remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification under certain conditions (bsc#1281314 bsc#1282051).

Changes for hplip:

  • Fix download of propietary plugin for 3.26.6
  • Update to HPLIP 3.26.6
  • Add support for the following new printers:
  • HP ScanJet Enterprise Flow N9000 sn1
  • HP ScanJet Enterprise Flow 9000 s1
  • HP ScanJet Pro 4200 s1
  • HP LaserJet Pro 4006dn printer
  • HP LaserJet Pro 4006dw printer
  • HP LaserJet Pro 4006n printer
  • HP LaserJet Pro 4002d printer
  • HP LaserJet Pro 4007dw printer
  • HP LaserJet Pro 4007n printer
  • HP LaserJet Pro 4008d
  • HP LaserJet Pro 4008dn
  • HP LaserJet Pro 4008dw
  • HP LaserJet Pro MFP 4112dw printer
  • HP LaserJet Pro MFP 4112fdn printer
  • HP LaserJet Pro MFP 4112fdw printer
  • HP LaserJet Pro MFP 4113dw printer
  • HP LaserJet Pro MFP 4113dwg printer
  • HP LaserJet Pro MFP 4113fdn printer
  • HP LaserJet Pro MFP 4113fdng printer
  • HP LaserJet Pro MFP 4113fdw printer
  • HP LaserJet Pro MFP 4113fdwg printer
  • HP LaserJet Pro MFP 4114dw
  • HP LaserJet Pro MFP 4114fdn
  • HP LaserJet Pro MFP 4114fdw
Record
SUSE-SU-2026:4364-1
Updated
2026-11-02
OSVSUSE-SU-2026:4371-1 No score

Security update for hplip

This update for hplip fixes the following issues:

  • CVE-2026-91097: high severity issue - multiple vulnerabilities enable remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification under certain conditions (bsc#1281303).
  • CVE-2026-91098: high severity issue - multiple vulnerabilities enable remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification under certain conditions (bsc#1281304).
  • CVE-2026-91099: medium severity issue - multiple vulnerabilities enable remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification under certain conditions (bsc#1281305).
  • CVE-2026-91100: medium severity issue - multiple vulnerabilities enable remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification under certain conditions (bsc#1281306).
  • CVE-2026-91101: medium severity issue - multiple vulnerabilities enable remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification under certain conditions (bsc#1281307).
  • CVE-2026-91102: high severity issue - multiple vulnerabilities enable remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification under certain conditions (bsc#1281308).
  • CVE-2026-91103: medium severity issue - multiple vulnerabilities enable remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification under certain conditions (bsc#1281309).
  • CVE-2026-91104: critical severity issue - multiple vulnerabilities enable remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification under certain conditions (bsc#1281313).
  • CVE-2026-91105: high severity issue - multiple vulnerabilities enable remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification under certain conditions (bsc#1281310).
  • CVE-2026-91106: critical severity issue - multiple vulnerabilities enable remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification under certain conditions (bsc#1281314 bsc#1282051).

Changes for hplip:

  • Fix download of propietary plugin for 3.26.6
  • Update to HPLIP 3.26.6
  • Add support for the following new printers:
  • HP ScanJet Enterprise Flow N9000 sn1
  • HP ScanJet Enterprise Flow 9000 s1
  • HP ScanJet Pro 4200 s1
  • HP LaserJet Pro 4006dn printer
  • HP LaserJet Pro 4006dw printer
  • HP LaserJet Pro 4006n printer
  • HP LaserJet Pro 4002d printer
  • HP LaserJet Pro 4007dw printer
  • HP LaserJet Pro 4007n printer
  • HP LaserJet Pro 4008d
  • HP LaserJet Pro 4008dn
  • HP LaserJet Pro 4008dw
  • HP LaserJet Pro MFP 4112dw printer
  • HP LaserJet Pro MFP 4112fdn printer
  • HP LaserJet Pro MFP 4112fdw printer
  • HP LaserJet Pro MFP 4113dw printer
  • HP LaserJet Pro MFP 4113dwg printer
  • HP LaserJet Pro MFP 4113fdn printer
  • HP LaserJet Pro MFP 4113fdng printer
  • HP LaserJet Pro MFP 4113fdw printer
  • HP LaserJet Pro MFP 4113fdwg printer
  • HP LaserJet Pro MFP 4114dw
  • HP LaserJet Pro MFP 4114fdn
  • HP LaserJet Pro MFP 4114fdw
Record
SUSE-SU-2026:4371-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
hplip
Alpine:v3.24
 before 3.26.6-r0
3.26.6-r0
hplip
AlmaLinux:8
 before 3.26.6-3.el8_10
3.26.6-3.el8_10
hplip-common
AlmaLinux:8
 before 3.26.6-3.el8_10
3.26.6-3.el8_10
hplip-gui
AlmaLinux:8
 before 3.26.6-3.el8_10
3.26.6-3.el8_10
hplip-libs
AlmaLinux:8
 before 3.26.6-3.el8_10
3.26.6-3.el8_10
libsane-hpaio
AlmaLinux:8
 before 3.26.6-3.el8_10
3.26.6-3.el8_10
hplip
AlmaLinux:9
 before 3.26.6-1.el9_8.3
3.26.6-1.el9_8.3
hplip-common
AlmaLinux:9
 before 3.26.6-1.el9_8.3
3.26.6-1.el9_8.3
hplip-libs
AlmaLinux:9
 before 3.26.6-1.el9_8.3
3.26.6-1.el9_8.3
libsane-hpaio
AlmaLinux:9
 before 3.26.6-1.el9_8.3
3.26.6-1.el9_8.3
Show 45 moreShow less
Affected packages
PackageAffectedFixed
hplip
AlmaLinux:10
 before 3.26.6-1.el10_2.3
3.26.6-1.el10_2.3
hplip-common
AlmaLinux:10
 before 3.26.6-1.el10_2.3
3.26.6-1.el10_2.3
hplip-libs
AlmaLinux:10
 before 3.26.6-1.el10_2.3
3.26.6-1.el10_2.3
libsane-hpaio
AlmaLinux:10
 before 3.26.6-1.el10_2.3
3.26.6-1.el10_2.3
hplip
TuxCare:AlmaLinux:9.2
 before 3.21.2-6.el9.alma.tuxcare.els3
3.21.2-6.el9.alma.tuxcare.els3
hplip-common
TuxCare:AlmaLinux:9.2
 before 3.21.2-6.el9.alma.tuxcare.els3
3.21.2-6.el9.alma.tuxcare.els3
hplip-libs
TuxCare:AlmaLinux:9.2
 before 3.21.2-6.el9.alma.tuxcare.els3
3.21.2-6.el9.alma.tuxcare.els3
libsane-hpaio
TuxCare:AlmaLinux:9.2
 before 3.21.2-6.el9.alma.tuxcare.els3
3.21.2-6.el9.alma.tuxcare.els3
hplip
TuxCare:AlmaLinux:9.6
 before 3.21.2-6.el9.alma.tuxcare.els3
3.21.2-6.el9.alma.tuxcare.els3
hplip-common
TuxCare:AlmaLinux:9.6
 before 3.21.2-6.el9.alma.tuxcare.els3
3.21.2-6.el9.alma.tuxcare.els3
hplip-libs
TuxCare:AlmaLinux:9.6
 before 3.21.2-6.el9.alma.tuxcare.els3
3.21.2-6.el9.alma.tuxcare.els3
libsane-hpaio
TuxCare:AlmaLinux:9.6
 before 3.21.2-6.el9.alma.tuxcare.els3
3.21.2-6.el9.alma.tuxcare.els3
hplip
Debian:12
 All versions, plus listed versions
3.22.10+dfsg0-23.22.10+dfsg0-2+deb12u13.22.10+dfsg0-33.22.10+dfsg0-3.1~exp13.22.10+dfsg0-4
Show 10 moreShow less
3.22.10+dfsg0-53.22.10+dfsg0-5.13.22.10+dfsg0-63.22.10+dfsg0-73.22.10+dfsg0-83.22.10+dfsg0-8.13.26.4+dfsg0-13.26.4+dfsg0-23.26.4+dfsg0-33.26.4+dfsg0-4
 None known
hplip
Debian:13
 All versions, plus listed versions
3.22.10+dfsg0-8.13.22.10+dfsg0-8.1+deb13u13.26.4+dfsg0-13.26.4+dfsg0-23.26.4+dfsg0-33.26.4+dfsg0-4
 None known
hplip
Red Hat:enterprise_linux:9::appstream
 before 0:3.26.6-1.el9_8.3
0:3.26.6-1.el9_8.3
hplip-libs
Red Hat:enterprise_linux:9::appstream
 before 0:3.26.6-1.el9_8.3
0:3.26.6-1.el9_8.3
libsane-hpaio
Red Hat:enterprise_linux:9::appstream
 before 0:3.26.6-1.el9_8.3
0:3.26.6-1.el9_8.3
hplip
Red Hat:enterprise_linux:10.2
 before 0:3.26.6-1.el10_2.3
0:3.26.6-1.el10_2.3
hplip-libs
Red Hat:enterprise_linux:10.2
 before 0:3.26.6-1.el10_2.3
0:3.26.6-1.el10_2.3
libsane-hpaio
Red Hat:enterprise_linux:10.2
 before 0:3.26.6-1.el10_2.3
0:3.26.6-1.el10_2.3
hplip
Rocky Linux:8
 before 0:3.26.6-3.el8_10
0:3.26.6-3.el8_10
hplip
Rocky Linux:9
 before 0:3.26.6-1.el9_8.3
0:3.26.6-1.el9_8.3
hplip
Rocky Linux:10
 before 0:3.26.6-1.el10_2.3
0:3.26.6-1.el10_2.3
hplip
SUSE:Linux Enterprise Server 12 SP5-LTSS
 before 3.26.6-3.14.2
3.26.6-3.14.2
hplip
SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5
 before 3.26.6-3.14.2
3.26.6-3.14.2
hplip
SUSE:Linux Enterprise Module for Basesystem 15 SP7
 before 3.26.6-150700.4.11.1
3.26.6-150700.4.11.1
hplip
SUSE:Linux Enterprise Module for Desktop Applications 15 SP7
 before 3.26.6-150700.4.11.1
3.26.6-150700.4.11.1
hplip
SUSE:Linux Enterprise Server 15 SP6-LTSS
 before 3.26.6-150600.4.15.1
3.26.6-150600.4.15.1
hplip
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
 before 3.26.6-150600.4.15.1
3.26.6-150600.4.15.1
hplip
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
 before 3.26.6-150400.3.25.1
3.26.6-150400.3.25.1
hplip
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
 before 3.26.6-150400.3.25.1
3.26.6-150400.3.25.1
hplip
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
 before 3.26.6-150400.3.25.1
3.26.6-150400.3.25.1
hplip
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
 before 3.26.6-150400.3.25.1
3.26.6-150400.3.25.1
hplip
SUSE:Linux Enterprise Server 15 SP4-LTSS
 before 3.26.6-150400.3.25.1
3.26.6-150400.3.25.1
hplip
SUSE:Linux Enterprise Server 15 SP5-LTSS
 before 3.26.6-150400.3.25.1
3.26.6-150400.3.25.1
hplip
SUSE:Linux Enterprise Server for SAP Applications 15 SP4
 before 3.26.6-150400.3.25.1
3.26.6-150400.3.25.1
hplip
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
 before 3.26.6-150400.3.25.1
3.26.6-150400.3.25.1
hplip
Ubuntu:16.04:LTS
 All versions, plus listed versions
3.15.7-0ubuntu43.15.7-0ubuntu53.15.11-0ubuntu13.15.11+repack0-13.15.11+repack0-1ubuntu1
Show 4 moreShow less
3.16.2+repack0-13.16.2+repack0-1ubuntu13.16.2+repack0-33.16.3+repack0-1
 None known
hplip
Ubuntu:18.04:LTS
 All versions, plus listed versions
3.17.7+repack0-33.17.10+repack0-13.17.10+repack0-23.17.10+repack0-33.17.10+repack0-43.17.10+repack0-5
 None known
hplip
Ubuntu:20.04:LTS
 All versions, plus listed versions
3.19.6+dfsg0-1ubuntu13.19.8+dfsg0-73.19.11+dfsg0-13.19.12+dfsg0-13.19.12+dfsg0-2
Show 6 moreShow less
3.19.12+dfsg0-33.19.12+dfsg0-3ubuntu13.19.12+dfsg0-4ubuntu13.20.3+dfsg0-13.20.3+dfsg0-23.20.3+dfsg0-2ubuntu0.1
 None known
hplip
Ubuntu:22.04:LTS
 All versions, plus listed versions
3.21.6+dfsg0-0ubuntu13.21.8+dfsg0-23.21.12+dfsg0-13.21.12+dfsg0-1ubuntu0.1
 None known
hplip
Ubuntu:24.04:LTS
 All versions, plus listed versions
3.22.10+dfsg0-2ubuntu13.22.10+dfsg0-2ubuntu23.23.12+dfsg0-0ubuntu43.23.12+dfsg0-0ubuntu53.23.12+dfsg0-0ubuntu5.1
 None known
hplip
Ubuntu:26.10
 All versions, plus listed versions
3.24.4+dfsg0-0ubuntu83.24.4+dfsg0-0ubuntu10
 None known
hplip
Ubuntu:26.04:LTS
 All versions, plus listed versions
3.24.4+dfsg0-0ubuntu53.24.4+dfsg0-0ubuntu73.24.4+dfsg0-0ubuntu83.24.4+dfsg0-0ubuntu8.1
 None known
hplip
openSUSE:Tumbleweed
 before 3.26.6-1.1
3.26.6-1.1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubmurrez/HP-HPLIP-Mass-CVE-checker-2026-09-2026-09-21
PoC in GitHubNxploited/CVE-2026-91097-CVE-2026-911062026-09-22

History

History
WhenChangedSources
2026-11-03affected, aliases, exploits, referencesOSV
2026-11-02createdCVE List, EUVD, GitHub Advisories, NVD, OSV, PoC in GitHub

References

Show 98 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open