This vulnerability (CVE-2026-8632) in HP Linux Imaging and Printing Software (HPLIP) involves improper neutralization of special elements in operating system commands, leading to command injection. This can result in escalation of privileges and arbitrary code execution on affected systems. The CVSS 4.0 base score is 8.5, reflecting high impact with local attack vector, low attack complexity, no user interaction required, and high impact on confidentiality, integrity, and availability. Red Hat has published advisories and released patched versions of HPLIP (version 3.23.12-8.el10_0.2) for Red Hat Enterprise Linux 10.0 Extended Update Support across multiple architectures. The vendor advisory confirms the availability of fixes and provides instructions for updating.

Successful exploitation of this vulnerability could allow a local attacker with low privileges to execute arbitrary code with escalated privileges, potentially compromising system confidentiality, integrity, and availability. This could lead to full system compromise on affected Red Hat Enterprise Linux 10.0 systems running vulnerable HPLIP versions.

Red Hat has released security updates for HPLIP to address CVE-2026-8632. Users of Red Hat Enterprise Linux 10.0 Extended Update Support should apply the updated packages (hplip-3.23.12-8.el10_0.2 and related) as provided in the Red Hat advisories (e.g., RHSA-2026:48606). No additional mitigation is required beyond applying the official patches. Patch status is confirmed as fixed in these updated packages.