CVE-2026-8631 is a heap-based buffer overflow vulnerability (CWE-122) in HP Inc's HP Linux Imaging and Printing Software (HPLIP). The issue is caused by an integer overflow in the hpcups processing path when processing specially crafted print data. This flaw can lead to arbitrary code execution and privilege escalation without requiring user interaction or privileges. Red Hat Product Security has rated this vulnerability as critical with a CVSS 4.0 base score of 9.3 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N). Red Hat has released patched versions of the hplip package for Red Hat Enterprise Linux 10.0 Extended Update Support across multiple architectures. The vendor advisory confirms the availability of an official fix and provides instructions for applying the update.

Successful exploitation of this vulnerability may allow an unauthenticated attacker to execute arbitrary code with elevated privileges on affected systems running vulnerable versions of HPLIP. This can lead to full system compromise. The vulnerability affects the processing of print data, which is a common operation on systems using HP printers. The critical severity and high CVSS score reflect the potential for significant impact if exploited.

An official fix is available from Red Hat. Users should apply the security update RHSA-2026:48606 or later for the hplip package on Red Hat Enterprise Linux 10.0 Extended Update Support and related architectures. The vendor advisory provides detailed instructions on how to obtain and apply the update. Applying this update mitigates the vulnerability by correcting the integer overflow and preventing the heap-based buffer overflow. No additional mitigation steps are indicated by the vendor advisory.