This vulnerability (CVE-2026-8631) involves an integer overflow in the hpcups component of HP Linux Imaging and Printing Software. When processing maliciously crafted print data, the integer overflow can lead to a heap-based buffer overflow, enabling arbitrary code execution or privilege escalation on affected systems. The flaw is exploitable remotely via network print job submissions without requiring privileges or user interaction. Red Hat's advisory confirms the issue and provides updated hplip packages to remediate the vulnerability. The CVSS v3 vector indicates network attack vector, low complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability.

Successful exploitation can result in arbitrary code execution or privilege escalation on affected systems running vulnerable versions of HPLIP. This allows attackers to gain unauthorized control or elevated privileges, potentially compromising system security. The vulnerability is remotely exploitable via network print job submissions without authentication or user interaction, increasing the risk of widespread impact in environments using vulnerable HPLIP versions.

A security update fixing this vulnerability is available from Red Hat for Red Hat Enterprise Linux 10.0 Extended Update Support. Users should apply the updated hplip packages (version 3.23.12-8.el10_0.2 or later) as provided in the Red Hat advisory RHSA-2026:48606. No additional mitigations are specified by the vendor. Patch status is confirmed as fixed in these updated packages.