This vulnerability (CVE-2026-91101) involves improper validation of array indices in HP Linux Imaging and Printing Software (HPLIP). The issue could be exploited to trigger various impacts such as remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification. The CVSS 4.0 base score is 5.1 (medium severity), with attack vector as physical, low attack complexity, no privileges or user interaction required, and high impact on availability. The affected versions are all versions prior to 3.26.6. HP has remediated this and other related vulnerabilities in HPLIP.

Successful exploitation could lead to remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification. The CVSS score indicates a medium severity impact primarily due to the potential for high availability impact and no required privileges or user interaction. However, the attack vector is physical, which limits remote exploitation scenarios.

HP has remediated this vulnerability in version 3.26.6 of HPLIP. Users should upgrade to version 3.26.6 or later to address this issue. No additional mitigation steps are indicated by the vendor advisory. Patch status is confirmed by the affectedVersions data indicating versions prior to 3.26.6 are vulnerable.