CVE-2025-26508 is a Critical flaw (CVSS 9.8) in certain HP LaserJet Pro, LaserJet Enterprise and LaserJet Managed printers. Processing a PostScript print job could lead to remote code execution and privilege elevation. Apply the firmware update listed in HP bulletin HPSBPI04007 for your model.
What's affected
- Products: certain HP LaserJet Pro, LaserJet Enterprise and LaserJet Managed printers
- Models named in this record: 115p9aw, 115q0aw, 17f27aw, 19gsaw, 1ps54a, 1ps55a, 1pu51a and 1pu52a
- Weakness: CWE-787, a out-of-bounds write
- Fixed: see HP security bulletin HPSBPI04007 for the firmware for each model
The record describes the issue as printers that may potentially be vulnerable to remote code execution and elevation of privilege when processing a PostScript print job. HP published one bulletin covering several CVEs for this family. The same bulletin covers CVE-2025-26506 and CVE-2025-26507, which are reported separately for other model groups. Check all three entries against your fleet.
The HP support page did not respond to my automated request, so I could not read the bulletin and I do not state firmware versions here. HP publishes the exact firmware per model, and a printer fleet often has many.
How to check if you're exposed
Match your printers to the models in the record, and then to the bulletin. The model identifier is usually on the label on the device and on the printer's status page.
Next, check which printers can receive print jobs from the network. A printer that accepts jobs from the whole network, or from the internet, is far more exposed than one that only accepts jobs from a print server.
# list devices that answer on the raw print port in your range (use only on networks you own)
nmap -p 9100 --open 192.0.2.0/24
Replace the example range with your own. Printers that are in the list and match an affected model are the first ones to update. Read the firmware version from the device's web page or its configuration report and compare it with the bulletin.
What to do now
- Open HP bulletin HPSBPI04007, find your models, and download the firmware update.
- Update the firmware on affected printers, starting with those that can be reached from the widest set of networks.
- Restrict who can send print jobs to the printers. Put them behind a print server, and block direct access to print ports from user networks and from the internet.
- Keep printers on their own network segment so that a compromised device cannot reach servers.
- Add printers to your asset inventory with model and firmware version, so the next bulletin takes minutes and not days.
Why it matters
The listed weakness is CWE-787. A buffer overflow means that the code that parses the incoming job writes more data than the space set aside for it, and that can let crafted input change what the device does. The vector shows a network attack with no privileges and no user interaction, with high impact on confidentiality, integrity and availability.
Printers are easy to overlook. They run a full operating system, they sit on the internal network, they hold stored documents and sometimes credentials for scanning to email or file shares. A compromised printer is a quiet place for an attacker to stay.
The record does not say the flaw is exploited in attacks, and it is not in the CISA Known Exploited Vulnerabilities catalog.
Quick check
Where is the fixed firmware for CVE-2025-26508?
HP names it in security bulletin HPSBPI04007. The record links only that page, and I could not read it, so check it for your exact model.
Do I need to be on the same network as the printer?
The CVSS vector says the attack is over the network and needs no privileges. Limiting who can reach the printer reduces the risk until you update.
Sources
Check your own dependencies with the free in-browser scan.
Last reviewed: 19 October 2026.
