looks like the new spooky 9.9 CVE is just a bug in CUPS that lets a remote attacker emulate the experience of installing an HP color printer driver on your linux system.
Granted, this is tragic, but also CUPS isn't exactly a pretty system to begin with, so not sure where to go from here.