CVE-2026-91106

HP has disclosed a critical vulnerability (CWE-122, heap-based buffer overflow) in HPLIP (HP Linux Imaging and Printing), part of a batch of externally reported flaws in several HPLIP components. According to the CVSS 4.0 vector, it can be triggered remotely over a network with low attack complexity, no privileges required, and no user interaction, and could enable remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification under certain conditions. Anyone running HPLIP to drive HP printers or scanners on Linux is potentially affected, with the greatest risk on systems where HPLIP-related services are reachable from the network. As of now there is no evidence of exploitation, no public proof of concept, and the flaw is not in CISA's Known Exploited Vulnerabilities catalog. HP has released remediation, so users should move to the patched HPLIP release.

What to do: Update HPLIP to the latest patched release from HP or apply the HPLIP security update provided through your Linux distribution's package manager. Audit systems for HPLIP/hp-* services exposed to untrusted networks and restrict access where possible. Monitor HP's security advisory for the specific fixed version and component details.