The update to HPLIP 3.26.4 fixes two critical vulnerabilities: CVE-2026-8631, which involves privilege escalation and/or arbitrary code execution via an integer overflow in the hpcups processing path, and CVE-2026-8632, which involves privilege escalation and/or arbitrary code execution through operating system command injection. Additionally, CVE-2025-43023 is fixed by updating GPG key support. The update also includes numerous new printer supports, fixes for configuration parser errors, compiler warnings, and refactors the package structure by moving utilities and dropping outdated drivers such as hpijs. These changes collectively improve security and functionality of the HPLIP software.

The vulnerabilities fixed could allow an attacker to escalate privileges or execute arbitrary code on affected systems running vulnerable versions of HPLIP. This poses a critical risk to system security, potentially allowing unauthorized control or disruption of printing services. The update mitigates these risks by addressing the integer overflow and command injection flaws, as well as improving overall package security and stability.

A security update is available that fixes the identified vulnerabilities. Users should apply the update to HPLIP version 3.26.4 or later to remediate these issues. The update also includes other fixes and improvements. There is no indication that additional mitigation steps are required beyond applying this official fix.