HPLIP CVE-2026-91097

Requires a host running HPLIP (HP's Linux Imaging and Printing driver stack, used with HP printers/scanners) and active user interaction (UI:A) - the victim must process attacker-influenced input such as a crafted print job, malicious device/network response, or handled file that reaches a vulnerable HPLIP component. No authentication is required (PR:N), but the mandatory user action and the HP-printing-specific deployment (only hosts with HPLIP installed and in use) meaningfully limit realistic exploitation. As an umbrella advisory, exact triggering conditions vary by individual bundled finding; consult HPSBPI04151 for component-level prerequisites.

This is an umbrella advisory (HPSBPI04151, CWE-787 out-of-bounds write) rolling up multiple externally reported HPLIP flaws whose worst-case impacts span RCE, privilege escalation, DoS, information disclosure, and file modification. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:H/VA:L = 7.0) signals a network-reachable, unauthenticated issue that nonetheless requires active user interaction (UI:A) and yields high integrity but only low confidentiality/availability impact - consistent with a memory-corruption bug reached when the victim processes attacker-controlled data rather than a wormable remote pre-auth RCE. No EPSS score, KEV listing, or public POC is provided, so there is no evidence of active exploitation; SSVC data is absent. Net: a genuinely serious but interaction-gated, HP-printing-specific vulnerability that merits patching on affected Linux hosts but is not an emergency drive-by threat. Note the aggregate nature - the 7.0/UI:A vector describes the representative worst case, and individual bundled findings may differ; consult the HP advisory for per-component detail.

An attacker lures a user of an HPLIP-enabled Linux host into processing malicious input - e.g., a crafted print job, malformed device/network response, or attacker-controlled file handled by an HPLIP component - triggering an out-of-bounds write. The resulting memory corruption is leveraged toward code execution or file modification in the context of the vulnerable component. No public exploit code is identified at time of analysis, and successful exploitation depends on the required user action (UI:A).