The hplip packages, which provide drivers for Hewlett-Packard printers and multi-function peripherals on Red Hat Enterprise Linux, contain two significant vulnerabilities. CVE-2026-8632 allows privilege escalation and arbitrary code execution through operating system command injection. CVE-2026-8631 involves an integer overflow in the hpcups component, also enabling arbitrary code execution and privilege escalation. Red Hat has issued security advisories RHSA-2026:26335 and RHSA-2026:48171 providing updated packages that fix these vulnerabilities across Red Hat Enterprise Linux 8 and 9.6 Extended Update Support versions for various CPU architectures. The advisories include detailed package versions and instructions for applying the updates.

Successful exploitation of these vulnerabilities could allow an attacker to escalate privileges and execute arbitrary code on affected systems running vulnerable versions of the hplip packages. This could compromise system integrity and security, potentially allowing unauthorized control over the affected host. The vulnerabilities affect multiple architectures and versions of Red Hat Enterprise Linux 8 and 9.6 Extended Update Support. There are no known exploits in the wild at the time of the advisory.

Red Hat has released official security updates that address these vulnerabilities. Users should apply the updated hplip packages as provided in Red Hat advisories RHSA-2026:26335 and RHSA-2026:48171. Detailed instructions and package information are available at https://access.redhat.com/articles/11258. Applying these updates will remediate the privilege escalation and arbitrary code execution issues. No additional mitigation steps are specified by the vendor.