CVE-2026-12555: CWE-379 Creation of temporary file in directory with insecure permissions in HP Inc HP Easy Start for macOS

This vulnerability, classified as CWE-379, concerns the creation of temporary files in directories that have insecure permissions within HP Easy Start for macOS. Such insecure file handling can lead to escalation of privilege by unauthorized users. The affected versions are those prior to 2.16.7.260722. The CVSS 4.0 score is 7.7, indicating a high severity with network attack vector, low attack complexity, and partial privileges required. HP has announced updates to address these issues but no explicit patch or remediation level is provided in the input data.

If exploited, this vulnerability could allow an attacker with limited privileges to escalate their privileges on the affected system. This could lead to unauthorized actions or access within the macOS environment where HP Easy Start is installed. No known exploits in the wild have been reported.

HP has released updates to mitigate these vulnerabilities. However, the provided data does not confirm the availability of an official patch or remediation level. Users should check HP's official advisory or update channels to ensure they have applied the latest version (2.16.7.260722 or later) to mitigate this issue.