HP Easy Start EUVD-2026-64949

Exploitation requires a low-privileged local user account on a macOS system with HP Easy Start prior to version 2.16.7.260722 installed. The vulnerable code path must be triggered - typically during a printer setup, initialization, or update operation that causes HP Easy Start to create temporary files with insecure directory permissions. The AT:P designation in the vendor CVSS 4.0 vector confirms that specific attack requirements must align, most likely a timing window consistent with a race condition against the temp file creation. What limits exploitation: the attacker must already have local shell or GUI access to the target macOS machine; remote unauthenticated exploitation is not consistent with CWE-379 and contradicts the AT:P flag despite the vendor's AV:N attribution; the vulnerable operation must be actively in progress or initiatable by the attacker. The vendor CVSS AV:N is inconsistent with this CWE class - teams should not plan for remote network exploitation without further clarification from HP.

The vendor-assigned CVSS 4.0 score is 7.7 with vector AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. A significant inconsistency exists: the AV:N (Network) attribution is incompatible with the CWE-379 root cause, which is an inherently local file system attack requiring physical or shell-level access to the target macOS host. The AT:P (attack requirements present) partially acknowledges special conditions, but the network vector remains unexplained by available data and should be verified with HP. No EPSS data was provided, and the absence of a KEV listing and public exploit code both argue against elevated immediate threat. Real-world exploitation is constrained to attackers with pre-existing local user access on macOS systems running a vulnerable HP Easy Start version, which substantially limits the attack surface compared to what AV:N would imply. Priority should be treated as medium for enterprise Mac fleets with HP printers, elevated to high if multi-user macOS environments are in scope.

A low-privileged local user on a shared macOS workstation with a vulnerable HP Easy Start version initiates or waits for a printer setup operation to trigger the vulnerable temp file creation path. The attacker uses a symlink or inotify-equivalent race to replace the temp file before HP Easy Start's privileged process reads or executes it, causing the elevated process to act on attacker-controlled content and granting the attacker administrator or root privileges. No public exploit code has been identified at time of analysis.