Ubuntu warns of HPLIP memory flaws that may allow code execution
Original title: USN-9037-1: HPLIP vulnerabilities
Two named CVEs cover memory corruption; a third issue is insecure file permissions, with no exploitation stated.
Ubuntu security notice USN-9037-1 says HPLIP mishandles certain data and input. CVE-2026-91097 is an out-of-bounds write and CVE-2026-91098 a heap-based buffer overflow; either could cause denial of service, expose sensitive information, or allow arbitrary code execution. A further issue creates files with insecure permissions that could expose or modify sensitive information. The snippet names no fixed versions.
Unconfirmed: The snippet is cut off and does not state fixed versions, attack vector, or exploitation.
- CVE-2026-91097 is an out-of-bounds write in HPLIP.
- CVE-2026-91098 is a heap-based buffer overflow.
- A separate issue creates files with insecure permissions.
- The snippet does not name fixed package versions.
Impact: denial of service, data exposure, or arbitrary code execution
| Product | Affected |
|---|---|
| HPLIP | — |
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-91098+1 related CVE | Heap Buffer Overflow in HP Linux Imaging and Printing (HPLIP) | 8.6 group max | — |
From the original article
It was discovered that HPLIP did not properly handle certain data, which could result in an out-of-bounds write. An attacker could possibly use this issue to cause a denial of service, expose sensitive information or execute arbitrary code. (CVE-2026-91097) It was discovered that HPLIP did not properly handle certain input, which could result in a heap-based buffer overflow.
ubuntu.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.