HP Fan Control App CVE-2026-8864

Exploitation requires the attacker to already hold a low-privileged local account on a machine with the vulnerable HP Fan Control App installed (PR:L, AV:L) - there is no remote or network path. The AT:P attack requirement means an additional precondition must hold: typically a directory in the privileged component's search path that the standard user can write to, plus the ability to cause the privileged service/process to start or restart (reboot, user logon, or service restart). Limiting factors that reduce real-world risk: no remote exploitation, prior local authentication is mandatory, the install must predate HP's update, and the host must present the writable-path condition; on single-user or fully patched systems the practical risk is low. No special remote conditions - this is strictly local privilege escalation.

Signals are moderate and internally consistent. The CVSS 4.0 base score of 7.3 (High) reflects local-only exploitation (AV:L) by an already-authenticated low-privileged user (PR:L) with no user interaction, but is tempered by an attack requirement (AT:P) that gates reliable exploitation on a non-default or timing-dependent condition. Vulnerable-system impact is full (VC:H/VI:H/VA:H) while subsequent-system impact is none (SC:N/SI:N/SA:N), so blast radius is confined to the local host. There is no KEV listing and no POC reported, and no EPSS score was supplied - the absence of these signals lowers urgency relative to a remotely exploitable or actively exploited bug. This is a real but not emergency-grade issue: meaningful on shared or multi-user HP workstations where untrusted local users exist, and lower priority on single-user devices. The local attack vector and the AT:P requirement are the key limiting factors.

A standard (non-admin) user on a shared HP workstation plants a malicious executable or DLL in a user-writable directory that lies within the privileged Fan Control component's resolution path, then waits for or triggers the service start (reboot, login, or service restart). When the privileged process resolves the unquoted path or insecure search order, it loads and runs the attacker's payload as SYSTEM, yielding full local administrator control. No public POC has been reported for this specific CVE.