CVE-2026-8631 is an integer overflow in the hpcups print path of HP Linux Imaging and Printing (HPLIP), scored 9.8 (critical). Crafted print data may allow privilege escalation or code execution. Apply the HP or Linux distribution update. The sections below cover affected versions, how to check your exposure and what to do first.
What's affected
HP describes a potential vulnerability in the HP Linux Imaging and Printing Software that may allow escalation of privileges or arbitrary code execution through an integer overflow when hpcups handles crafted print data. The weaknesses are CWE-122 and CWE-190.
The record does not list version numbers. Red Hat published several errata for it, so most Linux users get the fix through their distribution. The HP and Red Hat pages were not readable from my tooling, so confirm the fixed package version for your system. The record is not in the CISA KEV catalog.
How to check if you're exposed
Check whether HPLIP is installed and which version.
rpm -q hplip
dpkg -l | grep -i hplip
Then check your distribution advisory, such as the Red Hat errata linked in the record, for the fixed package version.
What to do now
- Update the hplip package from your distribution repository.
- If you do not print from the machine, remove HPLIP.
- Rebuild container images and golden images that include the package.
- Limit who can submit print jobs to shared servers.
- Confirm the version against the HP bulletin and your distribution advisory.
Why it matters
An integer overflow happens when arithmetic on a size wraps around, so a buffer is allocated smaller than the data written into it. The overflow then becomes a memory write error.
Print drivers parse complex data from many sources, which makes them an attractive target. Images and servers often include them by default.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Do desktops and servers both need the update?
Any Linux system with HPLIP installed does. Server images are easy to forget, since nobody thinks of them as printing hosts.
Sources
- HP security bulletin HPSBPI04118 linked from the record
- Red Hat erratum RHSA-2026:26228 linked from the record
- NVD record for CVE-2026-8631
Last reviewed: 19 October 2026.
