HPLIP EUVD-2026-80992

Requires HPLIP (HP Linux Imaging and Printing Software) installed and actively processing attacker-influenced input - a crafted print job, scanner/device response, or file handled by the HPLIP stack. The CVSS vector's UI:A (active user interaction) means exploitation is gated on the victim initiating or accepting the malicious operation (e.g., connecting to or printing from/scanning with a rogue device, or opening crafted content routed through HPLIP); it is not a fully autonomous remote exploit. Limiting factors: only Linux hosts with HPLIP installed (typically those using HP printers/scanners) are affected, exploitation is conditional ('under certain conditions' per HP), and impact varies by which of the bundled sub-vulnerabilities is triggered. Authentication is unauthenticated (PR:N) per the vendor vector.

This is a genuine priority for Linux fleets that use HP printers, but the aggregate nature of the advisory limits precision. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:A) describes network-reachable, unauthenticated exploitation with high confidentiality/integrity/availability impact, but crucially requires active user interaction (UI:A). No EPSS score, no CISA KEV listing, and no public POC are present in the supplied data, so exploitation is theoretical at time of analysis rather than observed. A key caveat: this single CVE bundles 'multiple externally reported vulnerabilities' with outcomes ranging from RCE to information disclosure 'under certain conditions,' and the assigned CWE-122 (heap-based buffer overflow) captures only one class among them - the true per-issue risk is not separable from this advisory alone. The 8.6 score is vendor-asserted and reasonable for the worst-case heap-overflow-to-RCE path, but the UI:A requirement and lack of any exploitation signal (EPSS/KEV/POC) place this below drive-by, worm-class threats. Treat as a high-priority patch for HP-printer Linux hosts, not an emergency for the general population.

An attacker positions a malicious device, print job, or crafted file that HPLIP will process (e.g., a rogue network printer/scanner or a booby-trapped document sent to an HP print pipeline), and the victim's HPLIP-enabled Linux host parses it. The crafted input triggers the heap-based buffer overflow (CWE-122), corrupting memory to achieve code execution, privilege escalation, or a crash. No public exploit code is identified at time of analysis, and successful attack depends on the victim actively interacting with the malicious input (UI:A).