HPLIP Vulnerabilities — Ubuntu Security Update (USN-9037-1)

It was discovered that HPLIP did not properly handle certain data, which
could result in an out-of-bounds write. An attacker could possibly use this
issue to cause a denial of service, expose sensitive information or execute
arbitrary code. (CVE-2026-91097)

It was discovered that HPLIP did not properly handle certain input, which
could result in a heap-based buffer overflow. An attacker could possibly
use this issue to cause a denial of service, expose sensitive information
or execute arbitrary code. (CVE-2026-91098)

It was discovered that HPLIP created certain files with insecure
permissions. An attacker could possibly use this issue to expose or modify
sensitive information. (CVE-2026-91099)

It was discovered that HPLIP did not properly handle certain input while
issuing an OS command. An attacker could possibly use this issue to execute
arbitrary commands. This issue only affected Ubuntu 16.04 LTS and Ubuntu
18.04 LTS. (CVE-2026-91100)

It was discovered that HPLIP did not properly validate certain array
indices. An attacker could possibly use this issue to cause a denial of
service, expose sensitive information or execute arbitrary code.
(CVE-2026-91101)

It was discovered that HPLIP did not properly handle certain input while
issuing an OS command. An attacker could possibly use this issue to execute
arbitrary commands. (CVE-2026-91102)

It was discovered that HPLIP did not properly handle certain numeric
values, which could result in an integer underflow. An attacker could
possibly use this issue to cause a denial of service, expose sensitive
information or execute arbitrary code. (CVE-2026-91103)

It was discovered that HPLIP did not properly handle certain input, which
could result in a heap-based buffer overflow. An attacker could possibly
use this issue to cause a denial of service, expose sensitive information
or execute arbitrary code. (CVE-2026-91104, CVE-2026-91105, CVE-2026-91106)