CVE-2026-8632

A flaw was found in the HP Linux Imaging and Printing Software (HPLIP). This vulnerability may allow a local attacker to achieve escalation of privileges and/or arbitrary code execution through operating system command injection. This could lead to an attacker gaining unauthorized control over the affected system.

An operating system command injection flaw, rated with an impact of Important by Red Hat, was found in the HP Linux Imaging and Printing (HPLIP) software. A local attacker with low privileges could use this flaw to inject operating system commands, resulting in escalation of privileges and/or arbitrary code execution on the affected system. Red Hat assigned a CVSS:3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), matching the NIST score, while the CVE.org record carries a CVSS:4.0 score of 8.5 for the same local, low-privilege attack vector. The hplip component in Red Hat Enterprise Linux 6 through 10 and Red Hat In-Vehicle OS 2 is affected, and a fix is being pursued for those streams; no fix is planned for the RHEL 6 Extended Lifecycle Support and RHEL 9.0 update streams. Fedora is not affected because the vulnerable code is not present in the Fedora hplip packages.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. For the affected Red Hat Enterprise Linux and Red Hat In-Vehicle OS streams, updated hplip packages have been or are being released; users should apply the available updates through their regular update channels.