CVE-2026-91101 is a critical flaw (CVSS 9.8) in HP Linux Imaging and Printing (HPLIP), one of six HPLIP CVEs covered by HP advisory HPSBPI04151. The record lists a weakness of type improper validation of array index. HP says it remediated the issue, so install the HPLIP update from HP or your distribution and confirm the fixed version in the advisory.
What's affected
- Product: HP Linux Imaging and Printing (HPLIP), the driver and tooling package used for HP printers and scanners on Linux.
- Affected versions: the record does not list them. HP's advisory is the authority, so read it before you decide which hosts are in scope.
- Fixed version: not stated in the record. Check advisory HPSBPI04151 for the HPLIP release that carries the fix.
- Siblings: the same advisory covers CVE-2026-91102, CVE-2026-91103, CVE-2026-91104, CVE-2026-91105, CVE-2026-91106.
How to check if you're exposed
Find out whether HPLIP is installed and which version you have. On most distributions the package manager answers that:
dpkg -l | grep -i hplip
rpm -qa | grep -i hplip
Compare the version you find with the fixed version named in HP's advisory. Also note which machines actually need HP printing from Linux. Print servers and shared workstations matter most.
What to do now
- Open HP advisory HPSBPI04151 and write down the fixed HPLIP version.
- Update HPLIP through your distribution's package manager or from HP, and confirm the installed version afterward.
- Remove HPLIP from servers and images that do not print. Fewer installed packages means fewer advisories to chase.
- Limit which networks can reach print services and scan services on Linux hosts.
- Re-run your dependency or package scan after the update to confirm the finding is gone.
Why it matters
The record lists CWE-129. The weakness class is an array index that is not checked against the size of the array it indexes. An index that falls outside the array lets code read or write memory it should not touch, and that can lead to a crash or to code execution.
The CVSS vector is network reachable, needs no privileges and no user action, which explains the 9.8 score. HP describes the group of fixes as covering possible remote code execution, privilege escalation, denial of service, information disclosure and unauthorized file modification. The record does not say which of those applies to this specific CVE, and it is not on the CISA Known Exploited Vulnerabilities list. Treat the advisory as the source of truth for scope.
You can look up CVE-2026-91101 on Gold and run the free in-browser dependency scan against your own manifests.
Quick check
Is this CVE exploited in the wild?
The record does not flag it as a CISA Known Exploited Vulnerability, and nothing in it says attacks have been seen. Patch on your normal critical schedule.
Sources
- HP security bulletin HPSBPI04151 (listed in the CVE record; the page could not be loaded in full when this post was reviewed, so confirm affected and fixed versions there)
- Gold entry for CVE-2026-91101
Last reviewed: 19 October 2026.
