CVE-2026-91097: bound LEDM HTTP response copies in http_read() of the SANE
hpaio backend (stack buffer overflow) (backport of HPLIP 3.26.6 and RHEL
c9s)
CVE-2026-91098: bound device-supplied data in the LEDM scan backend
(resolution lists, job Location header, BinaryURL and chunk size parsing)
(heap/stack buffer overflow) (backport of HPLIP 3.26.6 and RHEL c9s)
CVE-2026-91101: validate device-supplied channel ids in libhpmud MLC/DOT4
(out-of-bounds read/write) (backport of HPLIP 3.26.6)
CVE-2026-91103: reject MFPDTF blocks shorter than their header in the SANE
hpaio backend (integer underflow) (backport of HPLIP 3.26.6)
CVE-2026-91104: size the hpcups raster line buffer from each page header
(heap buffer overflow) (backport of HPLIP 3.26.6)
CVE-2026-91105: fix buffer overflows in the hpps PostScript filter (backport
of HPLIP 3.26.6)
CVE-2026-91106: fix integer overflow in the hpcups/hpijs halftoner output
width (heap buffer overflow) (backport of HPLIP 3.26.6 and RHEL c9s)