CVE-2026-14544: Hplip: incomplete fix for cve-2026-8631

Synopsis

An integer overflow vulnerability exists in HPLIP (HP Linux Imaging and Printing Software), specifically in the hpcups processing path that handles incoming print data. This is an incomplete fix for the earlier CVE-2026-8631, meaning the prior patch left an exploitable code path open. The flaw is reachable over the network with no authentication required, and successful exploitation gives an attacker the ability to escalate privileges or execute arbitrary code on the affected system. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the HPLIP service over the network; the AV:N vector token confirms this is exploitable remotely without any local foothold.

• AuthenticationNot required

  No credentials or account of any privilege level are needed to trigger the vulnerability; PR:N confirms the attack path is fully unauthenticated.

• Victim interactionNot required

  No user action such as opening a file or clicking a link is needed; the attacker can deliver the malicious print data directly without any victim participation.

• Attack complexityDetail

  Attack complexity is Low (AC:L), meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other variable environmental factors.

Blast Radius

• A successful attacker can execute arbitrary code in the context of the HPLIP service process, gaining a foothold on the host.
• Privilege escalation is possible, allowing the attacker to move from the service account to higher system privileges.
• All data accessible to the compromised process, including spooled print jobs and any credentials stored nearby, is readable by the attacker.
• The attacker can modify or delete files accessible to the process, disrupting printing operations and potentially tampering with system state.