CVE-2026-91105 Overview
HP has disclosed multiple vulnerabilities in HP Linux Imaging and Printing (HPLIP) software tracked under CVE-2026-91105. The flaws affect several software components within HPLIP and could enable remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification. The underlying weakness is classified as a heap-based buffer overflow [CWE-122]. Successful exploitation requires network reachability to the vulnerable component and user interaction, but no authentication. HP has published advisory HPSBPI04151 with remediation guidance for affected installations.
Critical Impact
Remote attackers can trigger heap corruption in HPLIP to execute arbitrary code, escalate privileges, or modify files on targeted Linux systems running vulnerable print components.
Affected Products
- HP Linux Imaging and Printing (HPLIP) software suite
- HP printer and multifunction device drivers packaged with HPLIP
- Linux distributions bundling vulnerable HPLIP components
Discovery Timeline
- 2026-09-16 - CVE-2026-91105 published to NVD
- 2026-09-17 - Last updated in NVD database
Technical Details for CVE-2026-91105
Vulnerability Analysis
CVE-2026-91105 covers multiple externally reported flaws in HPLIP, the open-source software stack that HP ships to support printing, scanning, and device management on Linux. The advisory identifies heap-based buffer overflow conditions [CWE-122] within HPLIP components that process untrusted input. When a vulnerable component parses malformed data, it writes beyond the bounds of a heap-allocated buffer. Corrupting adjacent heap metadata or object pointers can redirect control flow and lead to arbitrary code execution in the process context.
The consequences extend past code execution. HP notes the same class of issues can produce privilege escalation on systems where HPLIP components run with elevated permissions, denial of service through process crashes, and information disclosure from adjacent heap memory. Unauthorized file modification is also possible where HPLIP writes to privileged filesystem paths during device interaction.
Root Cause
The root cause is insufficient bounds checking during memory operations in HPLIP components that handle attacker-influenced data. Fixed-size heap allocations receive input whose length is not validated against buffer capacity before copy or format operations execute. This produces the heap corruption pattern captured under [CWE-122].
Attack Vector
The attack vector is network-based and requires user interaction. An attacker delivers crafted data to a vulnerable HPLIP component, for example through a malicious print job, device discovery response, or file processed by an HPLIP utility. When a user or automated workflow invokes the vulnerable code path, the heap overflow triggers. No prior authentication is required to reach the vulnerable parser.
Refer to the HP Security Advisory HPSBPI04151 for component-level technical details.
Stop Remote Code Execution Before It Runs
Singularity™ Endpoint detects and blocks exploit attempts at machine speed, including zero-days and novel attack techniques.
Stop Exploit AttemptsDetection Methods for CVE-2026-91105
Indicators of Compromise
- Unexpected crashes or core dumps from HPLIP processes such as hp-* utilities or the hpcups filter
- HPLIP components spawning shells, network clients, or non-print child processes
- Unauthorized modifications to files under /etc/hp/, /var/lib/hp/, or CUPS spool directories
- Outbound network connections initiated from HPLIP processes to non-HP infrastructure
Detection Strategies
- Monitor process trees for HPLIP binaries invoking /bin/sh, bash, python, or interpreters outside expected print workflows
- Enable core dump collection on Linux print servers and alert on repeated HPLIP crashes indicating exploitation attempts
- Inspect CUPS and HPLIP logs for malformed PPD, PJL, or IPP payloads preceding process termination
Monitoring Recommendations
- Track HPLIP package versions across the Linux fleet and flag hosts running versions predating the HP fix
- Alert on privilege transitions where HPLIP child processes acquire root or modify SUID files
- Baseline network egress from print servers and investigate deviations from known HP update endpoints
How to Mitigate CVE-2026-91105
Immediate Actions Required
- Apply the HPLIP updates referenced in HP Security Advisory HPSBPI04151 to every Linux host that has HPLIP installed
- Restrict network access to CUPS and HPLIP listeners so only authorized print clients can reach affected services
- Audit installed HPLIP versions using hp-check or the distribution package manager and prioritize systems exposed to untrusted networks
Patch Information
HP has remediated the reported issues in updated HPLIP releases. Administrators should install the fixed versions distributed through HP or their Linux vendor and consult HPSBPI04151 for exact fixed-version numbers per component. Rebuild any custom packages that statically link HPLIP libraries after applying the update.
Workarounds
- Disable HPLIP services on hosts that do not require HP printing or scanning by stopping and masking hplip.service and related units
- Remove HPLIP packages from servers that never interact with HP devices to eliminate the attack surface entirely
- Segment print servers on isolated VLANs and block inbound access from user workstations that do not need direct printer control
# Configuration example
# Check installed HPLIP version
hp-check -t
# Update HPLIP on Debian/Ubuntu-based systems
sudo apt update && sudo apt install --only-upgrade hplip hplip-data
# Update HPLIP on RHEL/Fedora-based systems
sudo dnf upgrade hplip hplip-common hplip-libs
# Disable HPLIP where not needed
sudo systemctl disable --now hplip.service
sudo systemctl mask hplip.service
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
