HPLIP EUVD-2026-81007

Exploitation requires the target system to run HP's HPLIP imaging/printing stack (the default HP printer/scanner driver on most Linux distributions) and to process attacker-influenced data through a vulnerable component. The description qualifies impact with 'under certain conditions,' and this is a bundled advisory, so the concrete prerequisites differ per sub-vulnerability - some paths likely need a malicious or spoofed network printer/device response, malformed print/scan job data, or a specific HPLIP feature (e.g., hp-plugin, CUPS/hpcups filter, or SANE scan backend) to be in use. Limiting factors: the AV:N/PR:N vector is a worst-case aggregate that may not hold for every underlying flaw (several HPLIP components are locally invoked), exact affected versions were not supplied, and no default-configuration remote-unauthenticated RCE has been independently confirmed. Not a special condition for the DoS/info-disclosure/file-modification sub-cases, which are lower impact than the RCE headline.

The vendor CVSS 4.0 base score is 9.3 (Critical) with an AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H vector, implying remote, unauthenticated, low-complexity exploitation with full confidentiality, integrity, and availability impact. However, this is an UMBRELLA advisory ('multiple externally reported vulnerabilities within HPLIP') and the description explicitly qualifies impact as occurring 'under certain conditions,' so the 9.3 almost certainly represents the worst-case aggregate across a bundle of distinct flaws (RCE, privilege escalation, DoS, information disclosure, unauthorized file modification) rather than a single clean network-RCE primitive. The AV:N/PR:N framing conflicts with the typical HPLIP deployment reality: many HPLIP components (hp-plugin binary installer, CUPS backends, hpcups filters, SANE scan backends) are locally invoked, and the heap overflow (CWE-122) may be reached via crafted printer/device responses or malicious print/scan data rather than a raw network listener - this warrants verification against the individual sub-CVEs in HP advisory hpsbpi04151. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of active exploitation or widespread automated targeting; SSVC framework data is also absent. Net: this is a genuinely high-priority patch item because of the RCE/heap-overflow claim in widely-bundled Linux printing software, but the 'unauthenticated network RCE against default config' reading should be treated as unconfirmed until the component-level details are checked, as printing-stack overflows frequently require local access or user/device interaction in practice.

An attacker delivers a crafted response or malformed data to a vulnerable HPLIP component (e.g., a rogue/compromised printer or a malicious device-discovery or print/scan payload) that triggers the heap-based buffer overflow, corrupting heap metadata to achieve code execution or, in weaker sub-cases, a crash or unauthorized file write. No public exploit code was identified at time of analysis, and because this is a bundled multi-vulnerability advisory the precise trigger path and whether it is truly remote-unauthenticated versus local/interaction-dependent varies per underlying flaw.