HP HPLIP CVE-2026-91100

Exploitation requires LOCAL access to a system running HP's HPLIP (HP Linux Imaging and Printing) software (AV:L) and ACTIVE user interaction (UI:A) - a local user must process or act on attacker-supplied input for the CWE-78 command injection to fire. No prior authentication is needed (PR:N), but the local vector plus mandatory user interaction are the key limiting factors: this cannot be triggered remotely against a default configuration without a user performing the enabling action. The exact HPLIP feature/component is not disclosed in the umbrella bulletin, so defenders should treat any HPLIP-processing workflow (print/scan job handling, device setup) as the potential trigger surface.

The vendor CVSS 4.0 score of 6.8 (AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:H/VA:L) describes a LOCAL, low-complexity issue that requires ACTIVE user interaction (UI:A) and yields high integrity impact (VI:H) with only low confidentiality/availability impact - consistent with CWE-78 OS command injection leading to unauthorized file/command modification rather than full remote takeover. Despite the umbrella description listing 'remote code execution,' the machine vector for THIS CVE is explicitly local (AV:L), so remote unauthenticated RCE is NOT supported by the vector - the broad description reflects the multi-CVE bulletin, not this specific finding. There is no EPSS score, no CISA KEV listing, and no public POC in the provided data, so exploitation is: no public exploit identified at time of analysis. No SSVC decision data was supplied. This is a moderate, locally-scoped, interaction-dependent flaw - not a drop-everything priority; the primary real-world risk is a local user being induced to trigger a malicious action (e.g., processing a crafted file/job) that injects OS commands.

An attacker crafts malicious input (such as a print job, device configuration, or file) that reaches an HPLIP component vulnerable to OS command injection; when a local user actively processes or opens it (UI:A), attacker-controlled shell commands execute in that user's context, allowing unauthorized file modification or command execution. No public exploit code is identified at time of analysis, and the local attack vector plus required user interaction limit mass exploitation.