HPLIP CVE-2026-91101

Requires a PHYSICAL/local attack vector (AV:P) against a system running HP's HPLIP software - the attacker must supply crafted input through a locally-reachable path (e.g., USB/device channel or local print/scan job) to trigger the improper array-index validation (CWE-129). No authentication or user interaction is needed once physical access is achieved (PR:N/UI:N), but the physical-access prerequisite is the primary limiter and rules out remote or network-based exploitation. Impact is limited to denial of service (availability); confidentiality and integrity are unaffected per the vector.

This is a genuinely low-to-moderate priority issue despite the description's broad language. The authoritative signal is the CVSS 4.0 vector (AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H), which is unambiguous: exploitation requires a PHYSICAL attack vector and yields availability impact ONLY (VC:N/VI:N/VA:H) - i.e., a denial-of-service/crash, not the remote code execution, privilege escalation, information disclosure, or file modification that the umbrella prose enumerates. The CWE-129 (improper validation of array index) is consistent with an out-of-bounds access causing a crash. The umbrella advisory hpsbpi04151 covers MULTIPLE CVEs across several components; the description's laundry list of impacts describes the advisory as a whole, NOT this specific CVE, which the vector constrains to physical-vector DoS. Contrast the signals: no EPSS score, no CISA KEV listing, and no public POC are provided, so there is no evidence of exploitation interest. The AV:P requirement (physical access to the machine/printer/USB path) is the dominant real-world limiter and sharply reduces practical risk. Net: treat as a routine patch, not an emergency. NOTE conflict: the free-text description implies remote code execution 'under certain conditions' but the assigned vector is AV:P/VA:H only - verify component-level scope with HP if RCE is a concern.

An attacker with physical/local access to a system running HPLIP feeds a crafted input (e.g., a malformed print job, scanner data, or device response over a local/USB path) that triggers the improper array-index validation, causing an out-of-bounds access that crashes the affected HPLIP component and denies printing/scanning service. No public exploit code is identified at time of analysis, and the physical attack requirement makes opportunistic or remote exploitation impractical.