HP HPLIP CVE-2026-91103

Requires physical attack vector (AV:P): the attacker must have local physical access or a direct hardware/USB connection to a system running HP's HPLIP printing stack to supply the input that triggers the CWE-191 integer underflow. No authentication (PR:N) and no user interaction (UI:N) are needed once physical access is achieved, but the physical-proximity requirement is the dominant limiting factor and precludes remote or network-based exploitation. Impact is limited to denial of service (availability only; no confidentiality or integrity impact per the scored vector). The affected version range is not specified in the CPE (wildcard), so version-specific applicability should be confirmed against HP advisory hpsbpi04151.

This is a genuine but low-priority issue. The vendor CVSS 4.0 vector (AV:P/AC:L/AT:N/PR:N/UI:N) with impact isolated to availability (VC:N/VI:N/VA:H) scores 5.1 (Medium) and describes a physical-attack-vector denial-of-service consistent with CWE-191 (integer underflow). The AV:P (Physical) requirement is the single largest risk limiter - an attacker needs physical proximity/connection to the affected device (plausibly a malicious USB or direct hardware connection to the HP printing stack), which sharply reduces exploitability versus a network flaw. No EPSS score, no CISA KEV listing, and no public exploit are present in the data, so this is: 'no public exploit identified at time of analysis.' NOTE A CONFLICT: the free-text description is an umbrella advisory citing RCE, privilege escalation, DoS, information disclosure, and unauthorized file modification 'under certain conditions,' and the Tags echo all of these - but the actual scored CVSS vector for THIS specific CVE ID reflects only a physical-access availability impact (DoS). The severe impacts in the description almost certainly belong to sibling CVEs covered by the same HP bulletin, not to CVE-2026-91103. Treat this record as a DoS, not RCE, unless HP's advisory attributes RCE to this exact ID.

An attacker with physical access to a Linux host running HPLIP connects a malicious or malformed USB printing/imaging device (or otherwise supplies crafted input over the local hardware path) that triggers an integer underflow in an HPLIP component. The wraparound leads to a crash or resource fault that renders the printing service unavailable. No public exploit code is identified at time of analysis, and the physical-access requirement makes opportunistic exploitation impractical.