CVE-2026-91104
Description
A flaw was found in HPLIP. A heap-based buffer overflow could potentially allow an attacker to achieve code execution, escalate privileges, cause a denial of service, disclose sensitive information, or perform unauthorized file modifications under certain conditions.
Statement
This vulnerability allows an unauthenticated attacker to achieve arbitrary code execution and privilege escalation, among other security impacts.
HPLIP provides printer drivers and tools for managing HP devices. The client tools are not exposed to the network. Printer, scanner, and fax drivers are used by CUPS (once configured with a print queue). The driver binaries are executed within a restricted environment under the unprivileged 'lp' user. This limits exploitation to a local attacker and restricts code execution to the unprivileged 'lp' user.
For these reasons, this issue has been rated with an important severity.
Default Red Hat Enterprise Linux security features, including SELinux enforcement, Address Space Layout Randomization (ASLR) and NX (No-Execute) stack protection, significantly increase the difficulty of achieving arbitrary code execution, limiting the impact of this vulnerability.
Mitigation
To mitigate this vulnerability, consider removing the hplip package if its functionality is not required by using the command indicated below. Note this will remove HP printer support and related utilities from the system.
sudo dnf remove hplip
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 8.4 | 9.8 | N/A |
| Attack Vector | Local | Network | N/A |
| Attack Complexity | Low | Low | N/A |
| Privileges Required | None | None | N/A |
| User Interaction | None | None | N/A |
| Scope | Unchanged | Unchanged | N/A |
| Confidentiality | High | High | N/A |
| Integrity Impact | High | High | N/A |
| Availability Impact | High | High | N/A |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat CVSS v3 Score Explanation
See the 'Statement' section for an explanation of the difference between the CVSS from Red Hat and NVD, specifically why the attack vector metric is set to local.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
