The HPLIP packages for Red Hat Enterprise Linux 8 contain two vulnerabilities: CVE-2026-8632, which allows privilege escalation and arbitrary code execution through operating system command injection, and CVE-2026-8631, which allows arbitrary code execution and privilege escalation via an integer overflow in the hpcups component. Red Hat Product Security has released updated packages to remediate these vulnerabilities as part of advisory RHSA-2026:26335. These vulnerabilities affect multiple architectures of Red Hat Enterprise Linux 8, including x86_64, s390x, ppc64le, and aarch64. The advisory rates the impact as Important and provides updated package versions to fix the issues.

Successful exploitation of these vulnerabilities could allow an attacker to escalate privileges and execute arbitrary code on affected systems running vulnerable versions of HPLIP. This could compromise system integrity and security. The vulnerabilities affect Red Hat Enterprise Linux 8 across multiple hardware architectures. No known exploits in the wild have been reported at this time.

Red Hat has released updated hplip packages for Red Hat Enterprise Linux 8 that address these vulnerabilities. Users should apply the security update described in Red Hat advisory RHSA-2026:26335 promptly to remediate the issues. For detailed update instructions, refer to https://access.redhat.com/articles/11258. No additional mitigation steps are indicated by the vendor advisory.