CVE-2026-91099: HP Linux Imaging and Printing RCE Vulnerability

CVE-2026-91099 Overview

HP has disclosed multiple vulnerabilities in the HP Linux Imaging and Printing (HPLIP) software stack, tracked collectively under CVE-2026-91099. The flaws affect several HPLIP software components and, under specific conditions, can enable remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification. The issue is categorized under [CWE-61] (UNIX Symbolic Link Following), indicating that at least one component mishandles symbolic links during file operations. The attack vector is local, and exploitation does not require user interaction or prior privileges according to the vendor's HP Security Bulletin.

Critical Impact

A local attacker can leverage improper symbolic link handling in HPLIP to modify files, disclose information, or escalate privileges on affected Linux systems.

Affected Products

• HP Linux Imaging and Printing (HPLIP) software components as listed in the HP security bulletin
• Linux distributions bundling vulnerable HPLIP releases
• Systems with HPLIP printer and scanner drivers installed

Discovery Timeline

• 2026-09-16 - CVE-2026-91099 published to the National Vulnerability Database
• 2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-91099

Vulnerability Analysis

CVE-2026-91099 groups multiple HPLIP defects into a single advisory. The most notable weakness is symbolic link following, classified as [CWE-61]. When a privileged HPLIP component reads or writes a file at a predictable path, a local attacker can replace that path with a symlink that points to an arbitrary file on the system. The privileged process then performs the file operation against the attacker-chosen target rather than the intended file.

HP describes downstream impacts spanning remote code execution, privilege escalation, denial of service, information disclosure, and unauthorized file modification. The specific outcome depends on which HPLIP component is targeted and the permissions the process holds when the symlink is dereferenced. Because HPLIP frequently runs helper utilities and installers with elevated rights, an attacker who wins a symlink race can escalate to higher privileges or overwrite protected system files.

Root Cause

The root cause is unsafe file handling in HPLIP components that operate on paths inside world-writable directories such as /tmp or user-controlled locations. The affected code does not verify whether a target path is a regular file before opening it, and does not use O_NOFOLLOW or equivalent protections. Attackers exploit this by pre-creating symlinks that redirect file operations.

Attack Vector

Exploitation requires local access to a host running a vulnerable HPLIP version. The attacker plants a symbolic link at a location HPLIP will subsequently touch, then triggers the vulnerable code path, for example by initiating a print job, invoking an HPLIP utility, or waiting for a scheduled maintenance action. When the privileged component follows the symlink, the write or read is redirected to the attacker's chosen target.

No verified public exploit code is available at the time of publication. See the HP Security Bulletin for component-level technical details.

Detection Methods for CVE-2026-91099

Indicators of Compromise

• Unexpected symbolic links in /tmp, /var/tmp, or HPLIP working directories that point to sensitive system files such as /etc/shadow, /etc/passwd, or configuration files under /etc.
• HPLIP processes (hp-* utilities, hpssd, hplip) performing writes to paths outside their documented working set.
• Unexplained ownership or permission changes on system files coinciding with HPLIP activity or print jobs.

Detection Strategies

• Audit file creation events in world-writable directories and correlate them with subsequent HPLIP process activity using Linux auditd rules on open, openat, and symlinkat syscalls.
• Inventory installed HPLIP versions across the Linux fleet and flag hosts running versions prior to the fixed release identified in the HP bulletin.
• Alert on privileged HPLIP processes opening files not owned by root or the invoking user, which can indicate symlink redirection.

Monitoring Recommendations

• Enable file integrity monitoring on /etc, /root, and other locations HPLIP has no legitimate reason to write to.
• Log and review invocations of HPLIP installer and maintenance scripts, particularly those executed via sudo or systemd units.
• Track package manager events to confirm timely rollout of patched HPLIP versions across managed Linux endpoints.

How to Mitigate CVE-2026-91099

Immediate Actions Required

• Upgrade HPLIP to the fixed version identified in the HP Security Bulletin as soon as your distribution publishes updated packages.
• Restrict local access to systems running HPLIP, since exploitation requires a local account on the target host.
• Review and remove untrusted symbolic links from /tmp and other shared writable directories on affected hosts.

Patch Information

HP has released remediated HPLIP components. Consult the vendor advisory at the HP Security Bulletin for the exact fixed version and per-component fix details. Apply the update through your Linux distribution's package manager to ensure dependent binaries and services are refreshed.

Workarounds

• Disable or uninstall HPLIP on hosts that do not require HP printer or scanner functionality until patching is complete.
• Enable kernel-level symlink protections such as fs.protected_symlinks=1 and fs.protected_hardlinks=1 via sysctl to reduce the exploitability of symlink-following flaws.
• Restrict execution of HPLIP setuid or root-invoked utilities to administrator accounts only.

# Configuration example
sudo sysctl -w fs.protected_symlinks=1
sudo sysctl -w fs.protected_hardlinks=1
echo 'fs.protected_symlinks=1' | sudo tee -a /etc/sysctl.d/99-hplip-hardening.conf
echo 'fs.protected_hardlinks=1' | sudo tee -a /etc/sysctl.d/99-hplip-hardening.conf

# Verify installed HPLIP version
hp-check -r | grep -i version