HPLIP CVE-2026-91099

Requires LOCAL access to a Linux system with HPLIP installed and an HPLIP component that follows attacker-controllable symbolic links (CWE-61) at a predictable filesystem path. Exploitation is limited to local, on-host attackers (AV:L) - there is no network-facing path in the scored vector despite the description mentioning 'remote code execution.' Impact is confined to limited unauthorized file read/modification (VC:L/VI:L), and success may depend on winning a symlink race or on the HPLIP component running before path validation. It affects only hosts where HPLIP is installed and active (i.e., systems using HP printing/scanning on Linux).

This is a moderate, locally-scoped issue rather than an urgent priority despite the alarming impact list in the description. The scored CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N, 5.1) describes LOCAL attack vector with only LOW confidentiality and integrity impact and no availability impact - which is far more modest than the description's blanket mention of 'remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification.' That mismatch is the key signal: this is an omnibus HP advisory (hpsbpi04151) aggregating MULTIPLE distinct findings under one narrative, so the description's worst-case verbs do not all map to this specific CVE's scored vector. The CWE-61 (UNIX symlink following) classification is consistent with the local, low-impact vector - a classic local file-manipulation/race weakness, not a remote RCE. Exploitation signals are quiet: no CISA KEV listing, no public proof-of-concept identified, and no EPSS score provided. No SSVC decision data was supplied. Net: prioritize as routine patching for Linux hosts running HPLIP, not as an emergency. NOTE: the CVSS vector (AV:L) contradicts the description's 'remote code execution' language - treat the vector as authoritative for THIS CVE and consult the HP advisory to confirm which sub-finding this identifier covers.

A local unprivileged user on a Linux system with HPLIP installed plants a crafted symbolic link at a predictable path that an HPLIP component subsequently follows, causing it to read or write a file outside the intended location. This yields limited unauthorized file disclosure or modification (VC:L/VI:L). No public exploit code has been identified, and exploitation requires local access rather than network reach.