A flaw was found in HPLIP

CVE-2026-14544 is an integer overflow in hpcups, the HPLIP filter binary that CUPS invokes when a print job is routed to an HP printer. A crafted print payload wraps a size calculation, corrupts heap memory, and — with enough work — yields arbitrary code execution *inside the print filter process*. Affected: HPLIP as shipped on RHEL 8, 9, and 10 (RHEL 6/7 unaffected, no upstream patch as of 2026-07-09). This is explicitly an incomplete fix for CVE-2026-8631, so the researcher clearly still has the file open.

The vendor's 9.8 (AV:N/AC:L/PR:N/UI:N) is a paper score. It assumes any attacker on the network can send a print job — which is only true if IPP/631 is reachable *and* the queue accepts jobs from unauthenticated peers. On a hardened enterprise fleet, CUPS binds to localhost, print servers sit inside the LAN, and the blast radius on success is the unprivileged lp account — not root, not domain, not tenant. This is a MEDIUM in practice, not a 9.8.

Why this verdict

• Reachability collapse: RHEL cupsd defaults bind to localhost. Attacker needs either an on-LAN foothold or a rare misconfigured public CUPS listener. This alone moves the practical AV from N to A/L on ≥99% of the fleet.
• Payload gating: The overflow only triggers when hpcups is the invoked filter. Sites with no HP printers or standardized on generic PostScript never load the vulnerable code — a wide swath of the affected RHEL population is not actually exploitable.
• Blast radius floor: Success = lp user in a short-lived filter process. lp has no shadow read, no domain trust, no secret store access, no sudo. Without a second bug, this is a nuisance, not an incident.
• Role multiplier: Print server / workstation / dev host — none are on the high-value-role catalog (no identity, hypervisor, PAM, backup, kernel-agent, or CI/CD role). The chain does not end in fleet compromise anywhere it lands, so the CRITICAL/HIGH floors from the deployment-role rule do not trigger.
• Signal state: EPSS 0.00511, no KEV, no public PoC, no in-the-wild reports. All independent signals agree with the downgrade.
• Counterweight — not lower: No upstream patch exists, this is an incomplete-fix follow-on (meaning researcher attention is active), and internal print servers are a common lateral-movement waypoint. That keeps it above LOW.

Why not higher?

HIGH would require either a plausible chain to root/domain without a second bug, or meaningful public-internet exposure. Neither holds: lp is a dead-end identity and CUPS-on-631 exposure to the internet is a small-single-digit percentage of installs. No KEV, no PoC, no active exploitation.

Why not lower?

LOW would ignore that this is an unauthenticated RCE primitive on a widely deployed Linux package with no patch shipped yet, and that it's the second bug in the same code path — researchers are looking. A committed insider or post-initial-access attacker on an internal print server absolutely can weaponize it as a lateral-movement stepping stone.

1. Bind cupsd to localhost only where remote printing is not required — Edit /etc/cups/cupsd.conf — remove Listen *:631, keep Listen localhost:631. Kills the network attack surface entirely on standalone hosts. No mitigation SLA at MEDIUM, but this is a 1-hour change with zero business impact on non-server hosts — do it this sprint.
2. Restrict IPP/631 at the network edge and between VLANs — Firewall 631/tcp inbound from untrusted networks and enforce east-west segmentation between user VLANs and print server VLANs. Prevents opportunistic lateral pivot. Target the 365-day noisgate remediation SLA for the segmentation project.
3. Remove HPLIP where no HP hardware exists — dnf remove hplip hplip-common on hosts with no HP printer dependency. Eliminates the vulnerable code path entirely. Verify with rpm -q hplip returning not installed.
4. Enforce authenticated submission on shared print servers — Set DefaultAuthType Negotiate or Basic in cupsd.conf and require Kerberos/AD auth on all queues. Turns AV:N into PR:L at minimum.
5. Confirm SELinux enforcing and hplip_t policy loaded — getenforce must return Enforcing; semodule -l | grep hplip must show the policy. SELinux confinement limits what a compromised hpcups can reach post-exploit.
6. Monitor for anomalous hpcups child processes and network connections — auditd rule: -a always,exit -F arch=b64 -S execve -F auid=lp -k hpcups_child. Any execve from the filter process to sh, bash, curl, wget, nc is exploitation until proven otherwise.

Run on each RHEL 8/9/10 host as root (needs to read cupsd.conf and query rpm). Invoke as sudo bash check-cve-2026-14544.sh. Exits 0 for PATCHED/NOT_APPLICABLE, 1 for VULNERABLE, 2 for UNKNOWN.

#!/usr/bin/env bash
# check-cve-2026-14544.sh — HPLIP hpcups integer overflow reassessment probe
# Usage: sudo bash check-cve-2026-14544.sh
set -u

STATUS="UNKNOWN"
REASON=""

# 1. Is HPLIP installed?
if ! rpm -q hplip >/dev/null 2>&1; then
  echo "PATCHED (hplip not installed — not applicable)"
  exit 0
fi

HPLIP_VER=$(rpm -q --qf '%{VERSION}-%{RELEASE}\n' hplip 2>/dev/null | head -n1)
RHEL_MAJOR=$(rpm -E %{rhel} 2>/dev/null)

# 2. Is cupsd listening beyond localhost?
CUPS_CONF="/etc/cups/cupsd.conf"
EXPOSED="no"
if [[ -r "$CUPS_CONF" ]]; then
  if grep -Eq '^[[:space:]]*Listen[[:space:]]+(\*|0\.0\.0\.0|[^l#].*):631' "$CUPS_CONF" 2>/dev/null; then
    EXPOSED="yes"
  fi
  if grep -Eq '^[[:space:]]*Port[[:space:]]+631' "$CUPS_CONF" 2>/dev/null; then
    EXPOSED="yes"
  fi
fi

# 3. Any HP-driven queues actually configured?
HP_QUEUES=0
if command -v lpstat >/dev/null 2>&1; then
  HP_QUEUES=$(lpstat -v 2>/dev/null | grep -c -iE 'hp:|hpfax:|hplip')
fi

# 4. Check Red Hat errata — replace with your patched NVR once RH ships the fix
#    Until then, any installed hplip on RHEL 8/9/10 is VULNERABLE by advisory.
case "$RHEL_MAJOR" in
  8|9|10)
    STATUS="VULNERABLE"
    REASON="hplip $HPLIP_VER on RHEL $RHEL_MAJOR — no vendor patch as of 2026-07-09"
    ;;
  6|7)
    STATUS="PATCHED"
    REASON="RHEL $RHEL_MAJOR not affected by CVE-2026-14544"
    ;;
  *)
    STATUS="UNKNOWN"
    REASON="unrecognized RHEL major: $RHEL_MAJOR"
    ;;
esac

echo "$STATUS: $REASON"
echo "  cups_listens_beyond_localhost=$EXPOSED"
echo "  hp_queues_configured=$HP_QUEUES"

case "$STATUS" in
  PATCHED) exit 0 ;;
  VULNERABLE) exit 1 ;;
  *) exit 2 ;;
esac

Sources

1. NVD — CVE-2026-14544
2. MITRE CVE Record — CVE-2026-14544
3. Cyberpress — HPLIP Integer Overflow Flaw
4. Red Hat Bugzilla 2496772
5. Red Hat CVE Portal — CVE-2026-14544
6. Prior root-cause CVE-2026-8631
7. CUPS Administrator's Guide — Listen directive
8. Fedora HPLIP advisory tracker