Cyber Resilience

CVE-2025-26506

Critical

Published: 14 February 2025

Published
14 February 2025
Modified
15 January 2026
KEV Added
Patch
CVSS Score v4 9.2 CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0206 84.3th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-26506 is a critical-severity Stack-based Buffer Overflow (CWE-121) vulnerability in Hp 499Q9E Firmware. Its CVSS base score is 9.2 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 15.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

Certain HP LaserJet Pro, HP LaserJet Enterprise, and HP LaserJet Managed Printers are affected by CVE-2025-26506, a vulnerability that can lead to remote code execution and elevation of privilege during PostScript print job processing. The issue is tracked under CWE-121 and carries a CVSS 4.0 score of 9.2 reflecting network attack vector, high impact on confidentiality, integrity, and availability, and the need for user interaction or specific conditions in some vectors.

An unauthenticated attacker with network access can submit a malicious PostScript job to trigger the flaw, achieving arbitrary code execution and privilege escalation on the printer without requiring prior authentication. The attack complexity is rated high and physical access or specific configuration states may influence exploitability.

HP has published an advisory at https://support.hp.com/us-en/document/ish_11953771-11953793-16/hpsbpi04007 that addresses the affected models and provides mitigation guidance. The EPSS score rose from a low baseline to a peak of 0.0609 on 2026-03-26 before receding to the current value of 0.0206, indicating a period of increased exploitation interest after disclosure.

EU & UK References

Vulnerability details

Certain HP LaserJet Pro, HP LaserJet Enterprise, and HP LaserJet Managed Printers may potentially be vulnerable to Remote Code Execution and Elevation of Privilege when processing a PostScript print job.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
Why these techniques?

The unauthenticated network-accessible stack-based buffer overflow in PostScript processing directly enables remote exploitation of a public-facing printer service (T1190) and achieves RCE with privilege escalation (T1068).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2025-26507Same vendor: Hp
CVE-2025-26508Same product: Hp 499M6A
CVE-2024-10238Shared CWE-121
CVE-2026-32955Shared CWE-121
CVE-2025-32061Shared CWE-121
CVE-2026-1457Shared CWE-121
CVE-2025-22467Shared CWE-121
CVE-2026-8631Same vendor: Hp
CVE-2026-2915Same vendor: Hp
CVE-2025-11531Same vendor: Hp

Affected Assets

hp
499q9e firmware
≤ 6.17.5.34-202412122146
hp
499q9f firmware
≤ 6.17.5.34-202412122146
hp
499r0a firmware
≤ 6.17.5.34-202412122146
hp
499r0e firmware
≤ 6.17.5.34-202412122146
hp
499r0f firmware
≤ 6.17.5.34-202412122146
hp
4ra80a firmware
≤ 6.17.5.34-202412122146
hp
4ra80e firmware
≤ 6.17.5.34-202412122146
hp
4ra80f firmware
≤ 6.17.5.34-202412122146
hp
4ra81a firmware
≤ 6.17.5.34-202412122146
hp
4ra81e firmware
≤ 6.17.5.34-202412122146
+85 more product configuration(s) — see NVD for full list

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

prevent

Directly requires timely identification, reporting, and patching of the stack-based buffer overflow flaw in PostScript processing on affected HP printers.

prevent

Mandates validation of PostScript print job inputs to detect and reject malformed data that could trigger the buffer overflow leading to RCE.

prevent

Implements memory protections such as stack guards or DEP that can mitigate exploitation of the stack-based buffer overflow even if input validation fails.

References