CVE-2026-91097

Executive Summary

CVE-2026-91097 is a set of externally reported weaknesses in HPLIP (HP Linux Imaging and Printing), the open-source print/fax/scan driver stack and the hp-* utilities that ship on most Linux distributions alongside HP hardware support. The root class assigned by NVD is CWE-787 (out-of-bounds write), and the vendor states the impact can include remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification under certain conditions. Affected parties are any environment running an unpatched HPLIP package on Linux/Unix endpoints, print servers, and containers — and the printer daemons these components talk to may expose them to unauthenticated network input.

Technical Analysis

The core technical signal in the available data is narrow but important: NVD classifies the finding under CWE-787, Out-of-bounds Write, while the vendor summary says the findings "affect several software components" inside HPLIP. Two structural facts follow from this and can be stated without speculation:

1. The defect class is memory-safety. Out-of-bounds writes occur when a routine computes a buffer length or offset incorrectly (or trusts one supplied by an attacker) and then writes past the end of an allocated region. On Linux with modern toolchains, consequences depend entirely on which object is adjacent in memory: an overflow inside a setuid/privilege-separated helper can flip a security decision and yield root; an overflow inside a network-facing daemon can corrupt internal state or provide a primitive that leads to code execution; an overflow inside a parser that processes an untrusted document stream typically gives a crash (denial of service) first.

2. The attack surface is distributed across the HPLIP component set. HPLIP is not a single binary. It includes locally run command-line tools, a system-side helper used to manage device state, a long-running per-user daemon that brokers access to attached printers, and network-facing utilities that speak IPP/SNMP/PJL to devices and to remote print queues. A single CWE-787 class applied to "several software components" therefore implies multiple distinct input paths, at least one of which the vendor characterizes as reachable remotely.

The out-of-bounds write class maps directly to the multi-impact framing in the vendor statement:

• Remote code execution / denial of service — a network-reachable component parses attacker-supplied data (job attributes, status responses, configuration streams) and writes beyond an allocated buffer.
• Privilege escalation — a local user triggers the write in a component running with elevated privileges, corrupting an adjacent pointer or function pointer or an in-memory flag used for authorization.
• Unauthorized file modification — memory corruption in a component that decides output file paths or permissions can be leveraged into writing or overwriting files outside intended boundaries.

Memory-safety bugs of this class have repeatedly appeared in printer management software because legacy parsing code assumes that whatever a device or peer sends fits into a fixed-size buffer. For this CVE specifically, the published description does not identify the vulnerable functions, files, or entry points, so any code-level walkthrough naming specific symbols would be fabrication. The defensible statement is: untrusted input reaches a heap- or stack-allocated buffer in an HPLIP component, the code writes past the buffer's boundary, and the resulting corruption is the mechanism behind whichever of the four advertised impacts an attacker pursues. No public exploit exists, no Nuclei template exists, and no EPSS score has been published, so real-world exploitation likelihood cannot be measured yet.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred strictly from the vulnerability class (CWE-787) and the vendor's impact statement. Specific function names, endpoints, and parameters are intentionally omitted because they are not present in the source data.

1. Reconnaissance / target identification. An attacker enumerates hosts exposing printing services over the network — IPP and the common print/printer UDP/TCP ports, plus any host running a HPLIP background daemon (hp-systray/device-broker style listener on a local or routable port). Linux workstations, print servers, CI runners with attached printers, and containers that mount /run/hplip or install the HPLIP package are all candidates. Shodan/Censys-style scanning for printer-service banners identifies internet-exposed instances; internal reconnaissance targets the management VLAN where these hosts usually live.

2. Triggering the out-of-bounds write.

• Remote vector: the attacker sends a malformed or deliberately oversized structure through the network-facing component (e.g., an IPP attribute or SNMP/PJL response whose length the parser does not validate). The component allocates a buffer based on the declared or implied size and then writes the received bytes past the allocation boundary.
• Local vector: a local user supplies crafted input to a hp-* utility or a device-configuration path processed by a component that runs with elevated privileges, producing the same class of overwrite.
• Device-driven vector: a compromised or malicious printer responds to a query from the Linux host with a response that overflows a buffer in the host-side parser, turning normal driver operation into the delivery mechanism.

3. Payload / execution method (class-level). The attacker shapes the overflow to control adjacent memory: overwrite a length field to gain a larger subsequent write, corrupt a pointer that is later dereferenced, or overwrite a function pointer / return address to redirect control flow into attacker-influenced data. Because the description does not reveal mitigations state (ASLR/CET/stack canaries) for the affected binaries, the reliability of control-flow hijacking cannot be asserted. Where hijacking is unreliable, the attacker at minimum achieves a deterministic trigger of the write, which the vendor concedes can cause denial of service on its own.

4. Post-exploitation impact. Depending on which component was targeted, the attacker reaches one of: code execution in the context of the affected process (root for the privileged helper path, user for the local-tool path), privilege escalation from a low-privileged Linux account, information disclosure from memory contents read out or exfiltrated through a corrupted response path, unauthorized modification of files writable by the process, and/or a crash that stops printing and can be looped to maintain denial of service. On a shared print server, compromise of the host-side daemon is a pivot into any device or queue that daemon manages.

Impact Assessment

• Blast radius: every Linux/Unix endpoint, print server, and container image that ships an unpatched HPLIP package. HPLIP is bundled by default in many distributions' print-support metapackages, so it frequently sits on hosts that were never deliberately chosen as print infrastructure.
• Confidentiality (C:H, provisional): the vendor explicitly lists information disclosure; memory corruption frequently leaks adjacent memory contents.
• Integrity (I:H, provisional): unauthorized file modification and code execution are both named by the vendor, and remote code execution in a privileged context subsumes full host integrity.
• Availability (A:H, provisional): denial of service is named explicitly and is the most reliably reproducible outcome of an out-of-bounds write.
• Attack complexity: the vector is estimated as network-reachable, low complexity, no privileges, no user interaction, consistent with the vendor's "remote code execution … under certain conditions" language. NVD has not published a CVSS score or vector, so the provisional CVSS:3.1 string above must be treated as an analyst estimate, not an authoritative rating.
• Exploitability signal: no public PoC, no Nuclei template, no CISA KEV listing, no EPSS score. Exploitation in the wild is currently unconfirmed. However, HPLIP's large installed base and the low skill floor of memory-corruption delivery via malformed network input mean weaponization should be anticipated once technical details circulate.
• Business context: a compromised print server is a quiet lateral-movement bridge — it routinely holds credentials, run-as-service identities, and network reach into user subnets.

Detection Guidance

Detection here cannot key on a known payload (none exists), so the rules below target the observable behaviors that memory-corruption exploitation of an HPLIP component would produce: abnormal process crashes, suspicious command lines against hp-* tooling, and anomalous print-protocol traffic.

Sigma Rule

title: Potential HPLIP Component Abuse or Memory-Corruption Crash (CVE-2026-91097)
id: 9f3c2a71-8b44-4e0d-a1c6-7d5e0b2f4c11
status: experimental
description: Detects crash dumps or abnormal termination of HPLIP binaries and suspicious invocation of hp-* utilities consistent with exploitation of out-of-bounds write flaws in HPLIP (CVE-2026-91097).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-91097
author: valtersit.com
date: 2026-01-01
tags:
  - attack.t1190
  - attack.t1068
logsource:
  product: linux
  service: auditd
detection:
  selection_hplip_proc:
    Image|endswith:
      - '/hp-setup'
      - '/hp-info'
      - '/hp-toolbox'
      - '/hp-systray'
      - '/hp-check'
      - '/hp-plugin'
      - '/hp-clean'
  selection_suspicious_parent:
    ParentImage|endswith:
      - '/bash'
      - '/sh'
      - '/python3'
      - '/perl'
      - '/nc'
      - '/socat'
  selection_segv:
    type: 'ANOM_ABEND'
    exe|endswith:
      - '/hp-setup'
      - '/hp-info'
      - '/hp-toolbox'
      - '/hp-systray'
      - '/hp-check'
  condition: selection_segv or (selection_hplip_proc and selection_suspicious_parent)
falsepositives:
  - Legitimate administrative scripts invoking hp-* tools through a shell wrapper
  - Automated printer provisioning systems
level: medium

YARA Rule

rule CVE_2026_91097_HPLIP_OOB_WRITE_INDICATORS
{
    meta:
        author = "valtersit.com"
        description = "Hunts for HPLIP binaries/scripts exhibiting indicators associated with unvalidated-length buffer handling tied to CVE-2026-91097 (CWE-787). Heuristic; correlate with vendor advisory."
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-91097"
        date = "2026-01-01"
        severity = "high"

    strings:
        $hplip = "HPLIP" ascii nocase wide
        $hp_lib = "/usr/share/hplip/" ascii
        $hp_lib2 = "/usr/lib/hplip/" ascii
        $hp_lib3 = "/usr/libexec/hplip/" ascii
        $hp_lib4 = "/usr/local/share/hplip/" ascii
        $hp_lib5 = "/usr/local/lib/hplip/" ascii
        $daemon = "hp-systray" ascii
        $setup  = "hp-setup" ascii
        $ipp    = "ipp" ascii nocase

    condition:
        uint32(0) == 0x464c457f and
        $hplip and
        ($hp_lib or $hp_lib2 or $hp_lib3 or $hp_lib4 or $hp_lib5) and
        any of ($daemon, $setup, $ipp)
}

Suricata IDS Rule

alert tcp any any -> any 631 (msg:"CVE-2026-91097 HPLIP Potential Out-of-Bounds Write Attempt via Oversized IPP Request"; flow:to_server,established; content:"POST|20|"; http_method; content:"/ipp"; http_uri; content:"Content-Length|3a| "; pcre:"/Content-Length\x3a\s*[0-9]{6,}/i"; pcre:"/(\x00{256,}|\x41{1024,}|\x90{1024,})/"; threshold:type limit, track by_src, count 5, seconds 60; classtype:attempted-admin; sid:202691097; rev:1; reference:cve,2026-91097;)

Note: no malicious payload signature exists for this CVE; the rule flags oversized or padding-heavy print-protocol requests that are atypical for legitimate clients, which is a behavioral heuristic rather than a precise exploit signature.

Elastic Detection

process where host.os.type == "linux" and event.category == "process" and event.type == "start" and
  process.name in ("hp-setup", "hp-info", "hp-toolbox", "hp-systray", "hp-check", "hp-plugin", "hp-clean") and
  process.parent.name in ("bash", "sh", "dash", "python3", "perl", "nc", "ncat", "socat")

Companion EQL for crash telemetry:

process where host.os.type == "linux" and event.category == "process" and event.action == "end" and
  process.name in ("hp-setup", "hp-info", "hp-toolbox", "hp-systray", "hp-check") and
  process.exit_code in (134, 139, -11, 11)

Splunk SPL Query

index=linux sourcetype=auditd OR sourcetype=syslog OR sourcetype=linux_secure
(comm="hp-setup" OR comm="hp-info" OR comm="hp-toolbox" OR comm="hp-systray" OR comm="hp-check" OR exe="*/hplip/*")
| eval suspicious=if(match(_raw,"segfault|general protection|SIGSEGV|core dumped|ANOM_ABEND") OR match(parent_comm,"bash|sh|python3|perl|nc|socat"),1,0)
| where suspicious=1
| stats count min(_time) as first_seen max(_time) as last_seen values(comm) as binaries by host, parent_comm
| where count > 3
| convert ctime(first_seen) ctime(last_seen)
| sort - count

Also alert on print-protocol volume anomalies:

index=network sourcetype=suricata
(alert.signature_id=202691097 OR dest_port=631 AND bytes_out>500000)
| stats dc(dest_ip) as targets sum(bytes_out) as total_bytes by src_ip
| where targets > 10 OR total_bytes > 10000000

Wazuh OSSEC Rule

<group name="hplip,cve-2026-91097,">
  <rule id="910970" level="10">
    <decoded_as>json</decoded_as>
    <field name="program">^hp-(setup|toolbox|systray|info|check|plugin|clean)$</field>
    <match>segfault|SIGSEGV|general protection|core dumped|ANOM_ABEND</match>
    <description>CVE-2026-91097: Possible HPLIP memory-corruption crash in $(program) - out-of-bounds write exploitation attempt.</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>vulnerability,exploit_attempt,</group>
  </rule>

  <rule id="910971" level="8">
    <if_sid>910970</if_sid>
    <field name="parent_process">^(bash|sh|dash|python3|perl|nc|ncat|socat)$</field>
    <description>CVE-2026-91097: HPLIP component launched by a shell or network tool - suspicious execution chain.</description>
  </rule>

  <rule id="910972" level="6">
    <decoded_as>json</decoded_as>
    <field name="dest_port">631</field>
    <field name="bytes_out" type="pcre2">^[0-9]{6,}</field>
    <description>CVE-2026-91097: Abnormally large IPP request payload toward port 631.</description>
    <group>network,print_protocol,</group>
  </rule>
</group>

Tuning note: benign HPLIP crashes on misconfigured systems produce noise; require correlation of rule 910970 with 910971 (suspicious parent) or with a spike in rule 910972 before elevating to incident.

Mitigation & Patch Guidance

Patch confidence is 0/4 — UNPATCHED. The vendor states remediation happened, but no version, advisory ID, or commit is available from tracked sources, so no specific "upgrade to version X" instruction can be given accurately.

1. Immediate mitigations (apply now):

• Restrict print-protocol access: firewall TCP 631 and printer-management UDP/TCP ports to trusted management hosts only. Do not expose IPP to untrusted networks.
• On print servers and multi-user Linux hosts, verify whether the HPLIP per-user daemon is running and disable it if printing is not required.
• Remove or restrict the setuid bit on unnecessary HPLIP helper binaries, and drop hp-* utilities from user PATHs on non-printing hosts.
• Enforce network segmentation between user VLANs and print infrastructure to limit lateral movement if a host is compromised.
• Enable core-dump and auditd capture on hosts running HPLIP so exploitation attempts (SIGSEGV/abort of hp-* processes) are visible rather than silent.

2. Patch/upgrade steps:

• Track the HP security bulletin page for the HPLIP advisory and the upstream HPLIP project release notes; identify the exact fixed version before deploying.
• Query your distribution's security tracker (e.g., Debian Security Tracker, Ubuntu USN/CVE tracker, Red Hat CVE database, SUSE CVE pages) by the CVE ID to obtain the distro-backported fixed package.
• Apply via the standard package manager (apt, dnf, zypper, apk) and verify the installed version with hp-check or the package query command; rebuild container images that vendor HPLIP.
• Because patch confidence is zero, do not assume any currently installed version is fixed. Re-check version status against the vendor advisory after it is published.

3. Long-term hardening:

• Add HPLIP/printing packages to your vulnerability-management allowlist of internet-exposed software; treat print servers as Tier-1 assets for patch SLA purposes.
• Inventory all hosts with HPLIP installed — including images and CI runners where printing is incidental — and remove it where unused.
• Run HPLIP components only inside a restricted service account or container with a minimal filesystem, so a memory-corruption bug cannot escalate to host root.
• Deploy compiler/hardening baselines (stack canaries, ASLR, _FORTIFY_SOURCE, RELRO, CET) and verify they are active on vendor-supplied binaries, since these directly reduce the exploitability of CWE-787 defects.
• Monitor the vendor advisory, NVD page, and CISA KEV for status changes; if this CVE enters KEV or a public PoC is released, re-prioritize accordingly.

References

• NVD — CVE-2026-91097: https://nvd.nist.gov/vuln/detail/CVE-2026-91097
• HP Security Bulletins (vendor advisory index for HPLIP remediation details — no bulletin number confirmed): https://support.hp.com/us-en/security-bulletins
• HPLIP official project site and release notes (fixed-version confirmation pending): https://developers.hp.com/hp-linux-imaging-and-printing
• CWE-787 Out-of-bounds Write: https://cwe.mitre.org/data/definitions/787.html
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-91097 not listed as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat actor / exploit-in-the-wild status: No public PoC, no Nuclei template, no public exploit code, no EPSS score, and no CISA KEV listing are associated with CVE-2026-91097 in the available data. No named threat-actor campaign is known to target this CVE. Exploitation status is unconfirmed; the practical near-term risk is driven by HPLIP's broad installation base and the multi-impact nature of the underlying out-of-bounds write class, not by observed activity.