RHSA-2026:82295 - Security Advisory

Topic

An update for hplip is now available for Red Hat Enterprise Linux 8.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

The hplip packages contain the Hewlett-Packard Linux Imaging and Printing Project (HPLIP), which provides drivers for Hewlett-Packard printers and multi-function peripherals.

Security Fix(es):

• hplip: potential memory buffer overflow (CVE-2020-6923)
• hplip: HP Linux Imaging and Printing Software - Use of DSA Key (CVE-2025-43023)
• hplip: HPLIP: Multiple vulnerabilities enabling local code execution and privilege escalation (CVE-2026-91099)
• hplip: HPLIP: Multiple vulnerabilities allow remote code execution and privilege escalation (CVE-2026-91098)
• hplip: HPLIP: Multiple vulnerabilities enable remote code execution and privilege escalation (CVE-2026-91097)
• hplip: HPLIP: Multiple vulnerabilities leading to remote code execution, privilege escalation, and denial of service (CVE-2026-91103)
• hplip: heap-based buffer overflow can lead to remote code execution (CVE-2026-91106)
• hplip: HPLIP: Multiple vulnerabilities allow remote code execution, privilege escalation, and denial of service. (CVE-2026-91100)
• hplip: HPLIP: Remote Code Execution and Privilege Escalation Vulnerabilities (CVE-2026-91101)
• hplip: heap-based buffer overflow can lead to remote code execution (CVE-2026-91104)
• hplip: HPLIP: Remote code execution and privilege escalation vulnerabilities (CVE-2026-91105)
• HPLIP: HPLIP: Multiple vulnerabilities could lead to remote code execution (CVE-2026-91102)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Enterprise Linux for x86_64 8 x86_64
• Red Hat Enterprise Linux for IBM z Systems 8 s390x
• Red Hat Enterprise Linux for Power, little endian 8 ppc64le
• Red Hat Enterprise Linux for ARM 64 8 aarch64
• Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 8.10 x86_64
• Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 8.10 aarch64
• Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 8.10 ppc64le
• Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 8.10 s390x

Fixes

• BZ - 2384011 - CVE-2025-43023 hplip: HP Linux Imaging and Printing Software - Use of DSA Key
• BZ - 2535600 - CVE-2026-91099 hplip: HPLIP: Multiple vulnerabilities enabling local code execution and privilege escalation
• BZ - 2535603 - CVE-2026-91098 hplip: HPLIP: Multiple vulnerabilities allow remote code execution and privilege escalation
• BZ - 2535607 - CVE-2026-91097 hplip: HPLIP: Multiple vulnerabilities enable remote code execution and privilege escalation
• BZ - 2535613 - CVE-2026-91103 hplip: HPLIP: Multiple vulnerabilities leading to remote code execution, privilege escalation, and denial of service
• BZ - 2535614 - CVE-2026-91106 hplip: heap-based buffer overflow can lead to remote code execution
• BZ - 2535615 - CVE-2026-91100 hplip: HPLIP: Multiple vulnerabilities allow remote code execution, privilege escalation, and denial of service.
• BZ - 2535617 - CVE-2026-91101 hplip: HPLIP: Remote Code Execution and Privilege Escalation Vulnerabilities
• BZ - 2535618 - CVE-2026-91104 hplip: heap-based buffer overflow can lead to remote code execution
• BZ - 2535621 - CVE-2026-91105 hplip: HPLIP: Remote code execution and privilege escalation vulnerabilities
• BZ - 2535622 - CVE-2026-91102 HPLIP: HPLIP: Multiple vulnerabilities could lead to remote code execution

CVEs

• CVE-2020-6923
• CVE-2025-43023
• CVE-2026-91097
• CVE-2026-91098
• CVE-2026-91099
• CVE-2026-91100
• CVE-2026-91101
• CVE-2026-91102
• CVE-2026-91103
• CVE-2026-91104
• CVE-2026-91105
• CVE-2026-91106

References

• https://access.redhat.com/security/updates/classification/#important