CVE-2026-14544 Hplip: incomplete fix for cve-2026-8631
Remote attackers can escalate privileges or execute arbitrary code via an integer overflow in HPLIP's hpcups processing path when handling crafted print data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-14544?
CVE-2026-14544 is a critical vulnerability in HPLIP, published on 3 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A flaw was found in HPLIP (HP Linux Imaging and Printing Software). This vulnerability, an incomplete fix for CVE-2026-8631, may allow a remote attacker to escalate privileges or achieve arbitrary code execution. This can occur through an integer overflow in the hpcups processing path when handling specially crafted print data.
Weakness: CWE-190
Which versions are affected by CVE-2026-14544?
Linux distribution packages (6)
hplip Red Hat:enterprise_linux:10.2 | All versions | 0:3.23.12-10.el10_2.5 |
hplip Red Hat:enterprise_linux:8::appstream | All versions | 0:3.18.4-14.el8_10 |
hplip Red Hat:enterprise_linux:9::appstream | All versions | 0:3.21.2-6.el9_8.5 |
hplip Rocky Linux:10 | All versions | 0:3.23.12-10.el10_2.5 |
hplip Rocky Linux:8 | All versions | 0:3.18.4-14.el8_10 |
hplip Rocky Linux:9 | All versions | 0:3.21.2-6.el9_8.5 |
How do I fix CVE-2026-14544?
Apply the vendor's patch.
Is CVE-2026-14544 being exploited?
There is no known exploitation of CVE-2026-14544 in the wild and no public exploit code.
Sources
Also known as GHSA-vwpr-fv2p-8c56, RHSA-2026:39976, RHSA-2026:40831, RHSA-2026:40894, RLSA-2026:39976, RLSA-2026:40831 and 2 more.