CVE-2026-91102

CVE-2026-91102 covers multiple externally reported vulnerabilities in HP's HPLIP (HP Linux Imaging and Printing) software, including an OS command injection issue (CWE-78), with an overall CVSS 4.0 score of 8.4 (high). The flaws can enable remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification under certain conditions. The CVSS vector indicates a local attack vector requiring no privileges but user interaction, suggesting an attacker must get a local user to trigger an affected HPLIP component with attacker-controlled input (e.g., via a crafted print or scan job). Anyone running HPLIP to drive HP printers or scanners on Linux is affected, and HPLIP is widely bundled with major distributions. HP has already remediated the issues; there is no evidence of exploitation, no public proof-of-concept, and the flaw is not in CISA's KEV catalog.

What to do: Update HPLIP to the patched release referenced in HP's security advisory (the fixed version number is not named in the available data), or take the updated hplip package from your distribution as soon as it is offered. On systems without HP printers or scanners (e.g., servers), remove the hplip package entirely to shrink the attack surface. Check HP's advisory for the specific affected components and fixed versions, as this CVE bundles several distinct flaws.