Threat database

A potential security vulnerability has been identified in HP One Agent for certain HP PC products, which might allow for escalation of privilege and/or arbitrary code execution. HP is releasing software updates to mitigate the potential vulnerability.

CVE-2026-91106 is a critical heap-based buffer overflow vulnerability in HP Linux Imaging and Printing Software (HPLIP). It affects versions from 0 up to but not including 3.26.6. The vulnerability could allow remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification under certain conditions. HP has identified and remediated multiple vulnerabilities in HPLIP, including this one.

CVE-2026-91105 is a heap-based buffer overflow vulnerability in HP Linux Imaging and Printing Software (HPLIP) versions prior to 3.26.6. This flaw could allow remote attackers to cause remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification. HP has identified and remediated this and other related vulnerabilities in HPLIP.

CVE-2026-91104 is a critical heap-based buffer overflow vulnerability in HP Linux Imaging and Printing Software (HPLIP). It affects versions from 0 up to but not including 3.26.6. The flaw could allow remote attackers to execute code, escalate privileges, cause denial of service, disclose information, or modify files without authorization under certain conditions. HP has identified and remediated this vulnerability.

CVE-2026-91103 is an integer underflow vulnerability (CWE-191) in HP Linux Imaging and Printing Software (HPLIP) versions before 3.26.6. HP has identified and fixed multiple vulnerabilities in HPLIP that could allow remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification under certain conditions. The CVSS 4.0 base score is 5.1, indicating a medium severity level.

HP has identified and remediated multiple externally reported vulnerabilities within HPLIP. The findings affect several software components that could potentially enable remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification under certain conditions.

CVE-2026-91101 is a medium severity vulnerability in HP Linux Imaging and Printing Software (HPLIP) caused by improper validation of array indexes (CWE-129). It affects versions prior to 3.26.6. The flaw could allow remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification under certain conditions. HP has identified and remediated multiple vulnerabilities in HPLIP, including this one.

CVE-2026-91100 is a medium-severity vulnerability in HP Linux Imaging and Printing Software (HPLIP) caused by improper neutralization of special elements in OS commands, leading to OS command injection. This vulnerability affects versions prior to 3.26.6. It could allow remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification under certain conditions. HP has identified and remediated multiple vulnerabilities in HPLIP, including this one.

CVE-2026-91099 is a medium severity vulnerability in HP Linux Imaging and Printing Software (HPLIP) involving symbolic link (symlink) following (CWE-61). Multiple vulnerabilities were identified and remediated by HP affecting several components that could allow remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification under certain conditions. The affected versions are those prior to 3.26.6. The CVSS 4.0 base score is 5.1, indicating a medium impact. No known exploits are reported in the wild. HP has remediated these issues, but no direct patch link is provided in the data.

A heap-based buffer overflow vulnerability (CWE-122) exists in HP Linux Imaging and Printing Software (HPLIP) versions prior to 3.26.6. This vulnerability could allow remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification under certain conditions. The vulnerability has been identified and remediated by HP.

CVE-2026-91097 is a high-severity vulnerability in HP Linux Imaging and Printing Software (HPLIP) involving an out-of-bounds write (CWE-787). This flaw affects versions prior to 3.26.6 and could allow remote attackers to cause denial of service, escalate privileges, execute code remotely, disclose information, or modify files without authorization under certain conditions. HP has identified and remediated this and other vulnerabilities in HPLIP. No known exploits are reported in the wild at this time.

A potential security vulnerability has been identified in the HP Support Assistant for versions prior to 9.53.2.0. The vulnerability could potentially allow a local attacker to escalate privileges due to insufficient access controls.

HP has identified a potential vulnerability in HP Web Jetadmin (WJA) that may allow an unauthenticated actor to read from or write to arbitrary files through a DLL hijacking mechanism.

The IP phone might use malicious input stored in configuration parameters and render it as content for the WebUI’s webpage.

Malicious use of a stolen cookie might allow modifications to the contents of the IP phone’s webpage.

The HP Fan Control App might allow local escalation of privileges. An updated version of HP Fan Control App has been released to mitigate this potential vulnerability.

A potential security vulnerability has been identified in the HP Accessory WMI Provider installer for some HP Docking Stations, which might allow escalation of privilege and/or arbitrary code execution. HP is releasing software updates to mitigate the potential vulnerability.

Potential security vulnerabilities have been identified in the HP One Agent for certain HP PC products, which might allow for escalation of privilege and/or denial of service. HP is releasing software updates to mitigate these potential vulnerabilities.

In certain scenarios when the admin has enabled Interactive Connectivity Establishment (ICE), a buffer overflow could enable remote code execution on Poly Voice products on the Linux platform.

HP System Optimizer might potentially be vulnerable to escalation of privilege. HP is releasing an update to mitigate this potential vulnerability.