EUVD-2026-81004
GHSA-4g7p-h353-2q55
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Worst-case bundled component is a remote heap-overflow RCE (AV:N/PR:N), but AC:H reflects heap-grooming difficulty; C/I/A:H mirror the RCE outcome, though local-only sub-issues would score lower.
Primary rating from Vendor (hp).
CVSS VectorVendor: hp
Lifecycle Timeline
4DescriptionCVE.org
HP has identified and remediated multiple externally reported vulnerabilities within HPLIP. The findings affect several software components that could potentially enable remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification under certain conditions.
AnalysisAI
Heap-based buffer overflow and related memory-safety flaws in HP Linux Imaging and Printing (HPLIP) can allow remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification on Linux hosts where HPLIP is installed and the affected component is active. This is an aggregate HP bulletin (hpsbpi04151) that bundles multiple externally reported issues under one CVE, so the published CVSS 4.0 score of 9.3 (AV:N/AC:L/PR:N/UI:N/VC:H/VI:H/VA:H) represents the worst-case component rather than any single flaw, and the assessed CVSS 3.1 score is lower (AV:N/AC:H) because several sub-issues are more likely local than remote and heap exploitation requires reliable memory grooming. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the target host to have HPLIP (HP Linux Imaging and Printing software) installed and the relevant vulnerable component active - typically a Linux system configured for HP printing/scanning. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is an aggregate HP advisory (hpsbpi04151) bundling MULTIPLE externally reported HPLIP vulnerabilities under one CVE, so the single CVSS 4.0 score of 9.3 (AV:N/AC:L/PR:N/UI:N/VC:H/VI:H/VA:H) represents the worst-case component rather than any one flaw - a key interpretive caveat. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary fix is to install the updated HPLIP release referenced in HP security bulletin hpsbpi04151 (https://support.hp.com/us-en/document/ish_15646959-15646984-16/hpsbpi04151); HP states the issues are remediated, so patched HPLIP packages should be applied through the distribution's package manager or HP's released update, with the exact fixed version taken from that bulletin rather than assumed - patch status is therefore 'Patch available per vendor advisory' with no exact fix version independently confirmed in the provided data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Linux systems with HPLIP installed and determine if the affected component (e.g., printing or scanning services) is active; disable or restrict network access to HPLIP services (CUPS, scanner) where not business-critical, and monitor for anomalous activity. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Heap-based buffer overflow (CWE-122) in HP's HPLIP - the HP Linux Imaging and Printing Software stack shipped as the def
HPLIP (HP Linux Imaging and Printing Software) is affected by multiple heap-based buffer overflow vulnerabilities (CWE-1
Heap-based buffer overflows and related memory-safety flaws in HPLIP (HP Linux Imaging and Printing Software) let remote
Command injection weaknesses in HP Linux Imaging and Printing Software (HPLIP) allow a local attacker to execute arbitra
Out-of-bounds write flaws in HPLIP (HP Linux Imaging and Printing Software) can corrupt memory when a user processes att
Command injection (CWE-78) in HP's HPLIP (HP Linux Imaging and Printing) software enables an unauthenticated local user
Denial of service in HP's HPLIP (HP Linux Imaging and Printing Software) printing stack is reachable when a physically-p
Denial of service in HP Linux Imaging and Printing Software (HPLIP) can be triggered by a physically present attacker wh
Local attackers with valid credentials on Linux systems running HPLIP can exploit symbolic-link handling flaws (CWE-61)
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today