HPLIP CVE-2026-91102

Requires LOCAL access to a host running HP's HPLIP software with associated HP imaging/printing hardware or services (AV:L), plus active user interaction (UI:A) - the attacker must either be a local user or induce a legitimate user to perform an action that feeds attacker-controlled input into a vulnerable HPLIP component that constructs an OS command (CWE-78). No authentication or elevated privileges are needed (PR:N), but the attack is NOT remotely exploitable and does not work against a host with no user action. Because this is a bundled advisory, exact triggering features vary per underlying vulnerability; limiting factors are the local vector, required user interaction, and the need for HPLIP to be installed and in use.

The vendor CVSS 4.0 score of 8.4 is driven by high confidentiality, integrity, and availability impact (VC:H/VI:H/VA:H), but the vector itself moderates the real-world risk: AV:L means this is a LOCAL attack vector, not remote, and UI:A requires active user interaction. Despite PR:N (no privileges required), the local + user-interaction requirement means an attacker cannot exploit this over the network against a default deployment. No EPSS score, no CISA KEV listing, and no public POC are provided in the input, so there is no evidence of active or imminent exploitation - this is a proactively-remediated vendor advisory rather than a fire-drill. A key caveat: this is a BUNDLED advisory (hpsbpi04151) covering MULTIPLE distinct vulnerabilities aggregated under one CVE/score, so the single CVSS vector may represent the worst-case component and not every underlying flaw. The description hedges heavily ('could potentially enable... under certain conditions'), which is consistent with a rollup rather than a single confirmed exploit path. Net: a legitimately high-severity local flaw worth patching on HP-printer Linux hosts, but not an internet-facing emergency.

On a Linux workstation running HPLIP with an HP printer, a local unprivileged user (or a lured legitimate user) triggers a crafted input - such as a malicious printer/scanner configuration, device name, or file processed by an HPLIP component - that is passed unsanitized into a shell command (CWE-78). Because user interaction is required (UI:A), the attacker either acts as the local user or induces the victim to perform the triggering action, achieving command injection with the resulting code executing in the HPLIP/service context. No public exploit code is identified at time of analysis.