Skip to main content

HP HPLIP CVE-2026-91100

| EUVDEUVD-2026-80997 MEDIUM
OS Command Injection (CWE-78)
2026-09-16 hp GHSA-c8c7-3cv3-4g6g
Privilege Escalation RCE Denial Of Service Information Disclosure Linux Command Injection HP Hp Linux Imaging And Printing Software Hplip
6.8
CVSS 4.0 · Vendor: hp
Share

Severity by source

Vendor (hp) PRIMARY
6.8 MEDIUM
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
6.6 MEDIUM

Vendor vector is explicitly local with required user interaction (AV:L/UI:R), no auth (PR:N); command injection gives high integrity (I:H) with only low confidentiality and availability impact.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:L
4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (hp).

CVSS VectorVendor: hp

Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
A
Scope
X

Lifecycle Timeline

4
Metadata Corrected
Sep 16, 2026 - 20:40 vuln.today
tag: Linux added
Patch available
Sep 16, 2026 - 20:18 EUVD
Analysis Generated
Sep 16, 2026 - 19:44 vuln.today
CVE Published
Sep 16, 2026 - 18:47 cve.org
MEDIUM 6.8

DescriptionCVE.org

HP has identified and remediated multiple externally reported vulnerabilities within HPLIP. The findings affect several software components that could potentially enable remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification under certain conditions.

AnalysisAI

Command injection (CWE-78) in HP's HPLIP (HP Linux Imaging and Printing) software enables an unauthenticated local user to execute commands or modify files with high integrity impact (VI:H) after active user interaction, matching HP's CVSS 4.0 score of 6.8 (AV:L/AC:L/PR:N/UI:A/VC:L/VI:H/VA:L) and the independent CVSS 3.1 assessment (AV:L/AC:L/PR:N/UI:R/C:L/I:H/A:L). The HP security bulletin HPSBPI04151 bundles this issue with other externally reported HPLIP flaws that could lead to remote code execution, privilege escalation, denial of service, or information disclosure, but the exact vulnerable component is not disclosed. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires LOCAL access to a system running HP's HPLIP (HP Linux Imaging and Printing) software (AV:L) and ACTIVE user interaction (UI:A) - a local user must process or act on attacker-supplied input for the CWE-78 command injection to fire. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The vendor CVSS 4.0 score of 6.8 (AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:H/VA:L) describes a LOCAL, low-complexity issue that requires ACTIVE user interaction (UI:A) and yields high integrity impact (VI:H) with only low confidentiality/availability impact - consistent with CWE-78 OS command injection leading to unauthorized file/command modification rather than full remote takeover. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation HP has released security bulletin HPSBPI04151 to remediate these issues; apply the vendor-supplied HPLIP updates as soon as possible, following the advisory at https://support.hp.com/us-en/document/ish_15646959-15646984-16/hpsbpi04151 for exact patch versions (the available data does not specify a fixed version number, so treat this as 'Patch available per vendor advisory'). … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Hp Linux Imaging And Printing Software Hplip

View all
CVE-2026-91106 CRITICAL
9.3 Sep 16

Heap-based buffer overflow (CWE-122) in HP's HPLIP - the HP Linux Imaging and Printing Software stack shipped as the def
CVE-2026-91104 CRITICAL
9.3 Sep 16

Heap-based buffer overflow and related memory-safety flaws in HP Linux Imaging and Printing (HPLIP) can allow remote cod
CVE-2026-91105 HIGH
8.6 Sep 16

HPLIP (HP Linux Imaging and Printing Software) is affected by multiple heap-based buffer overflow vulnerabilities (CWE-1
CVE-2026-91098 HIGH
8.6 Sep 16

Heap-based buffer overflows and related memory-safety flaws in HPLIP (HP Linux Imaging and Printing Software) let remote
CVE-2026-91102 HIGH
8.4 Sep 16

Command injection weaknesses in HP Linux Imaging and Printing Software (HPLIP) allow a local attacker to execute arbitra
CVE-2026-91097 HIGH
7.0 Sep 16

Out-of-bounds write flaws in HPLIP (HP Linux Imaging and Printing Software) can corrupt memory when a user processes att
CVE-2026-91103 MEDIUM
5.1 Sep 16

Denial of service in HP's HPLIP (HP Linux Imaging and Printing Software) printing stack is reachable when a physically-p
CVE-2026-91101 MEDIUM
5.1 Sep 16

Denial of service in HP Linux Imaging and Printing Software (HPLIP) can be triggered by a physically present attacker wh
CVE-2026-91099 MEDIUM
5.1 Sep 16

Local attackers with valid credentials on Linux systems running HPLIP can exploit symbolic-link handling flaws (CWE-61)

Same weakness CWE-78 – OS Command Injection

View all
CVE-2019-15107 CRITICAL POC
9.8
CVE-2024-51378 CRITICAL POC
9.8
CVE-2014-6271 CRITICAL POC
9.8
CVE-2018-11138 CRITICAL POC
9.8
CVE-2014-6278 HIGH POC
8.8
CVE-2017-6334 HIGH POC
8.8
CVE-2024-50603 CRITICAL POC
10.0
CVE-2024-9474 MEDIUM POC
6.9

Same technique Privilege Escalation

View all
CVE-2024-0012 CRITICAL POC
9.3
CVE-2025-47812 CRITICAL POC
10.0
CVE-2013-0422 CRITICAL POC
9.8
CVE-2013-0632 CRITICAL POC
9.8
CVE-2024-9474 MEDIUM POC
6.9
CVE-2017-5689 CRITICAL POC
9.8
CVE-2021-20021 CRITICAL POC
9.8
CVE-2017-12635 CRITICAL POC
9.8

Share

CVE-2026-91100 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy