HPLIP CVE-2026-91104

Exploitation requires the target host to have HPLIP (HP Linux Imaging and Printing software) installed and the relevant vulnerable component active - typically a Linux system configured for HP printing/scanning. Because this is a bundled advisory, prerequisites differ per flaw: the RCE path implies reaching a network-facing or input-processing HPLIP component, while the privilege-escalation and unauthorized-file-modification issues most likely require prior local access to the host. Limiting factors: the product is only present on Linux systems with HPLIP deployed (not a universal service), heap-overflow exploitation demands reliable memory grooming, and the true attack vector for several sub-issues is probably local rather than remote despite the aggregate AV:N vector.

This is an aggregate HP advisory (hpsbpi04151) bundling MULTIPLE externally reported HPLIP vulnerabilities under one CVE, so the single CVSS 4.0 score of 9.3 (AV:N/AC:L/PR:N/UI:N/VC:H/VI:H/VA:H) represents the worst-case component rather than any one flaw - a key interpretive caveat. The vendor vector claims remote, unauthenticated, network-reachable code execution with high confidentiality/integrity/availability impact, which if literal is a genuine top priority. However, HPLIP is a Linux printing/imaging driver stack whose components are frequently local-only (root/SUID daemons, CUPS backends), so the blanket AV:N is questionable for at least some of the bundled issues (privilege escalation and 'unauthorized file modification' read as local vectors) - verify per-component scope with HP. There is no EPSS score, no CISA KEV listing, and no public POC in the provided data, meaning no evidence of active exploitation; this reads as a proactively patched vendor batch rather than an in-the-wild threat. Net: treat as high-priority patching for Linux fleets running HP printers, but the '9.3 remote RCE' framing likely overstates the realistic reachability of the privesc/file-modification subset.

An attacker reachable to a Linux host running HPLIP sends crafted input to a vulnerable HPLIP component (e.g., a print/scan data path or discovery service), triggering the CWE-122 heap-based buffer overflow to corrupt memory and execute code, or leverages a local privilege-escalation flaw in a root-privileged HPLIP daemon. No public exploit code is identified at time of analysis, and exploitation of the heap overflow realistically requires precise heap grooming.