HPLIP CVE-2026-91105

Exploitation requires active user interaction (CVSS UI:A) on a Linux host running HPLIP - for example the victim performing a print or scan operation, connecting to or accepting data from an attacker-controlled or spoofed HP imaging device, or opening/processing attacker-supplied imaging data through HPLIP. No prior authentication or privileges are needed (PR:N), and the vector is network-reachable (AV:N), but the required victim action and dependence on HPLIP being installed and in use with HP printing/scanning are the primary limiting factors. The advisory is a bundled multi-vulnerability roll-up and does not name the exact vulnerable component, protocol, or configuration; specific preconditions must be confirmed against HP bulletin hpsbpi04151.

This is a vendor-authored (HP) bundled advisory covering MULTIPLE distinct vulnerabilities in HPLIP, scored in aggregate at CVSS 4.0 8.6 (High). The vector AV:N/AC:L/PR:N/UI:A with VC:H/VI:H/VA:H and CWE-122 (heap-based buffer overflow) points to a network-reachable heap overflow enabling potential remote code execution, but the UI:A (active user interaction required) metric is the key limiting signal - successful exploitation depends on a victim performing an action (e.g., printing/scanning to or connecting a malicious/spoofed device, or processing attacker-supplied data), not purely passive remote compromise. No EPSS score, no CISA KEV listing, and no public POC are present in the provided data, so there is no evidence of active exploitation - treat exploitation status as 'no public exploit identified at time of analysis.' The 8.6 is a vendor self-assessment for a rolled-up set of issues ('remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification'), meaning the single CVE ID conflates several impacts with varying real severity; the described worst-case (RCE via heap overflow) is credible but gated behind user interaction, making this an elevated-but-not-emergency priority absent exploitation signals. Because the description is deliberately vague ('under certain conditions'), specific attack preconditions cannot be confirmed from the input and should be verified against HP bulletin hpsbpi04151.

An attacker crafts a malicious printer/scanner response or a poisoned imaging file that, when processed by a Linux host running HPLIP, overflows a heap buffer (CWE-122). A victim triggers the vulnerable code path through normal print/scan activity or by connecting to an attacker-controlled or spoofed HP device, allowing the attacker to corrupt heap memory and potentially execute code in the HPLIP process context. No public exploit code is identified at time of analysis.