CVE-2026-91097: HP Linux Imaging and Printing RCE Vulnerability

CVE-2026-91097 Overview

HP has remediated multiple externally reported vulnerabilities affecting HP Linux Imaging and Printing (HPLIP). The issues span several software components and can enable remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification depending on the conditions. The root weakness is categorized as an out-of-bounds write [CWE-787], a memory corruption class that frequently leads to attacker-controlled code paths. The vulnerability requires network attack access and user interaction to trigger successful exploitation.

Critical Impact
An attacker who convinces a user to interact with malicious input can trigger memory corruption in HPLIP, resulting in potential code execution, integrity loss, or service disruption on affected Linux systems.

Affected Products

HP Linux Imaging and Printing (HPLIP) software suite
HP printing and scanning components bundled with HPLIP on Linux hosts
Downstream Linux distributions redistributing vulnerable HPLIP packages

Discovery Timeline

2026-09-16 - CVE-2026-91097 published to the National Vulnerability Database (NVD)
2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-91097

Vulnerability Analysis

HPLIP provides drivers and utilities that enable Linux systems to communicate with HP printers and multifunction devices. The advisory covers multiple weaknesses across several components, with the primary weakness classified as an out-of-bounds write [CWE-787]. An out-of-bounds write occurs when a program writes data past the end, or before the beginning, of an intended memory buffer. This condition corrupts adjacent memory and can be leveraged for control-flow hijacking.

The vulnerability is reachable over the network and requires low attack complexity, but the attacker must induce a user to perform an action for exploitation to succeed. Successful exploitation can result in remote code execution, privilege escalation on the host, denial of service, information disclosure, or unauthorized modification of files handled by HPLIP components.

Root Cause

The root cause is an out-of-bounds write in HPLIP code paths that process externally supplied data. The affected routines fail to validate buffer boundaries before writing, allowing crafted input to overwrite memory beyond the target buffer. HP has not published low-level implementation details in the public NVD entry, and the HP Security Bulletin remains the authoritative technical source.

Attack Vector

An attacker delivers crafted input to a vulnerable HPLIP component over the network. Because user interaction is required, the attack typically depends on tricking a local user into initiating a print job, opening a document, or interacting with a malicious device or file that the HPLIP stack subsequently processes. When the vulnerable routine processes the input, the out-of-bounds write corrupts memory and can lead to code execution, denial of service, or unauthorized file modification. No public proof-of-concept exploit code is currently available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-91097

Indicators of Compromise

Unexpected crashes, segmentation faults, or coredumps generated by HPLIP processes such as hp-* utilities or hpcups filter binaries.
HPLIP daemons spawning shells, package managers, or network utilities that are not part of normal printing workflows.
Unexpected writes or modifications under HPLIP configuration paths such as /etc/hp/ or user-level ~/.hplip/ directories.

Detection Strategies

Enumerate installed HPLIP versions across Linux endpoints and compare against the fixed version listed in the HP Security Bulletin.
Monitor process ancestry for HPLIP components launching child processes outside their expected execution profile.
Alert on repeated abnormal terminations of HPLIP services, which can indicate exploitation attempts against the out-of-bounds write condition.

Monitoring Recommendations

Aggregate Linux endpoint telemetry, syslog, and audit logs into a central analytics platform to correlate HPLIP process anomalies across the fleet.
Track outbound network connections initiated by HPLIP-related processes, which should typically be limited to local printer devices.
Review filesystem integrity monitoring output for changes to HPLIP binaries, drivers, and PPD files following user print activity.

How to Mitigate CVE-2026-91097

Immediate Actions Required

Apply the HPLIP update referenced in the HP Security Bulletin as soon as the fixed package is available for your Linux distribution.
Inventory Linux hosts running HPLIP and prioritize patching on systems that process documents from untrusted sources.
Restrict which users can initiate print jobs from untrusted files or interact with untrusted network-attached printer devices.

Patch Information

HP has released an update that remediates the vulnerabilities disclosed in the security bulletin. Administrators should consult the HP Security Bulletin for the specific fixed component versions and follow the distribution-appropriate upgrade procedure using the system package manager or the HPLIP installer provided by HP.

Workarounds

Disable or uninstall HPLIP on Linux systems that do not require HP printing or scanning functionality until the patch is applied.
Segment printers and print servers on a restricted network segment to limit exposure to attacker-controlled input.
Enforce least privilege on user accounts that interact with HPLIP so that successful exploitation yields limited follow-on capability.

bash

# Configuration example: verify installed HPLIP version and remove if not required
hp-check -r | grep -i "HPLIP version"
sudo apt-get remove --purge hplip hplip-data   # Debian/Ubuntu
sudo dnf remove hplip hplip-common             # RHEL/Fedora