HP Linux Printing Software Vulnerability Allows Remote Code Execution

A critical security vulnerability has been identified in HP Linux Imaging and Printing (HPLIP) software that could allow remote attackers to execute arbitrary code on affected systems. The flaw, tracked as CVE-2026-14544, carries a high-severity CVSS v3 score of 9.8, highlighting the significant risk it poses to enterprise and Linux-based environments that rely on HP printing services.

The vulnerability exists within the hpcups component of HPLIP, specifically in the processing path that handles print jobs. Security researchers found that the issue stems from an integer overflow condition that can be triggered when the software processes specially crafted print data. This flaw is particularly concerning because it represents an incomplete fix for the previously disclosed vulnerability CVE-2026-8631, suggesting that earlier remediation efforts failed to address the underlying issue fully.

In practical terms, an attacker can exploit this weakness by sending a malicious print job to a targeted system. Since printing services are often exposed across networks in enterprise environments, this creates a viable remote attack vector. The vulnerability does not require authentication or user interaction, making exploitation significantly easier.

Once triggered, an integer overflow can lead to memory corruption, enabling attackers to execute arbitrary code or escalate privileges within the printing service, which typically runs under the “lp” user. The technical root of the flaw aligns with CWE-190, which refers to integer overflow or wraparound issues. Such vulnerabilities can result in improper memory allocation, logic errors, or buffer overflows.

In this case, the overflow condition can disrupt how the hpcups filter processes print data, potentially allowing attackers to manipulate execution flow. This can lead to a range of impacts including system crashes, denial-of-service conditions, unauthorized command execution, and bypassing security controls.

Red Hat has confirmed that multiple versions of its enterprise Linux offerings are affected, including Red Hat Enterprise Linux 8, 9, and 10. Older versions such as RHEL 6 and 7 are not impacted as the vulnerable code is not present in those releases. At the time of disclosure, no official patches had been issued for affected versions, leaving systems exposed if mitigations are not applied.

Security teams are advised to take immediate steps to reduce risk. Restricting access to printing services to trusted users and internal networks can significantly limit the attack surface. Organizations that do not rely on HPLIP are encouraged to remove the package entirely, although this may disrupt printing functionality. Monitoring print job activity and isolating print servers can also help detect or prevent exploitation attempts.

Given the ease of exploitation and the high impact across confidentiality, integrity, and availability, this vulnerability represents a serious threat. Organizations using Linux-based printing infrastructure should prioritize mitigation efforts while awaiting official security updates from vendors.