CyberSecBulletin
CVE-2025-26506NVD status: Analyzed

Certain HP LaserJet Pro, HP LaserJet…: Stack-based Buffer Overflow

Published Updated By the CyberSecBulletin desk

CVE-2025-26506 is a critical-severity stack-based buffer overflow vulnerability in Certain HP LaserJet Pro, HP LaserJet Enterprise, HP LaserJet Managed Printers from HP, with a CVSS 3.1 base score of 9.8 out of 10. It can be exploited remotely over the network by an unauthenticated attacker, without any action from a user. Affected Certain HP LaserJet Pro, HP LaserJet Enterprise, HP LaserJet Managed Printers versions: See HP security bulletin reference for affected versions. The record does not name a fixed version, so check the vendor advisory. There is no confirmed exploitation so far. EPSS estimates a 1.11% chance of exploitation within 30 days, higher than 66% of scored CVEs.

Patch this week

Critical severity: a successful attack would have severe impact.

What to do

  1. Update 4ra85f Firmware to 6.17.5.34-202412122146 or a later version.
  2. Update 4ra85v Firmware to 6.17.5.34-202412122146 or a later version.
  3. Update 4ra86a Firmware to 6.17.5.34-202412122146 or a later version.
  4. Read the advisory on support.hp.com for workarounds and exact fixed builds.
  5. Until you can update, restrict network access to the affected service so it is not reachable from untrusted networks.

Affected products and versions

VendorProductAffected versionsFixed in
HPCertain HP LaserJet Pro, HP LaserJet Enterprise, HP LaserJet Managed PrintersSee HP security bulletin reference for affected versionsNot stated
HP4ra85f Firmwarebefore 6.17.5.34-2024121221466.17.5.34-202412122146
HP4ra85v Firmwarebefore 6.17.5.34-2024121221466.17.5.34-202412122146
HP4ra86a Firmwarebefore 6.17.5.34-2024121221466.17.5.34-202412122146
HP4ra86e Firmwarebefore 6.17.5.34-2024121221466.17.5.34-202412122146
HP4ra86f Firmwarebefore 6.17.5.34-2024121221466.17.5.34-202412122146
HP4ra87a Firmwarebefore 6.17.5.34-2024121221466.17.5.34-202412122146
HP4ra87e Firmwarebefore 6.17.5.34-2024121221466.17.5.34-202412122146
HP4ra87f Firmwarebefore 6.17.5.34-2024121221466.17.5.34-202412122146
HP4ra88a Firmwarebefore 6.17.5.34-2024121221466.17.5.34-202412122146
HP4ra88e Firmwarebefore 6.17.5.34-2024121221466.17.5.34-202412122146
HP4ra88f Firmwarebefore 6.17.5.34-2024121221466.17.5.34-202412122146
HP4ra89a Firmwarebefore 6.17.5.34-2024121221466.17.5.34-202412122146
HP4ra89v Firmwarebefore 6.17.5.34-2024121221466.17.5.34-202412122146
HP5hh48a Firmwarebefore 6.17.5.34-2024121221466.17.5.34-202412122146
HP5hh48v Firmwarebefore 6.17.5.34-2024121221466.17.5.34-202412122146
HP5hh51a Firmwarebefore 6.17.5.34-2024121221466.17.5.34-202412122146
HP499m6a Firmwarebefore 6.17.5.34-2024121221466.17.5.34-202412122146
HP499m7a Firmwarebefore 6.17.5.34-2024121221466.17.5.34-202412122146
HP5hh52a Firmwarebefore 6.17.5.34-2024121221466.17.5.34-202412122146
HP5hh53a Firmwarebefore 6.17.5.34-2024121221466.17.5.34-202412122146
HP5hh59a Firmwarebefore 6.17.5.34-2024121221466.17.5.34-202412122146
HP5hh64a Firmwarebefore 6.17.5.34-2024121221466.17.5.34-202412122146
HP5hh64e Firmwarebefore 6.17.5.34-2024121221466.17.5.34-202412122146
HP5hh64f Firmwarebefore 6.17.5.34-2024121221466.17.5.34-202412122146

Version data comes from the organisation that assigned the CVE; 35 further products are omitted here. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
NetworkCan be exploited remotely over a network, including the internet.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
NoneNo account or login is needed.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
HighData or code can be modified at will.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Scored by NVD.

Scoring systemScoreSeverityScored by
CVSS 4.09.2CriticalCNA (hp.com)
CVSS 3.19.8CriticalNVD

Official description

Certain HP LaserJet Pro, HP LaserJet Enterprise, and HP LaserJet Managed Printers may potentially be vulnerable to Remote Code Execution and Elevation of Privilege when processing a PostScript print job.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Stack-based Buffer Overflow

The product writes past the end of a buffer that was allocated on the stack.

How developers prevent this class of flaw

  • Use automatic buffer overflow detection mechanisms that are offered by certain compilers or compiler extensions. Examples include: the Microsoft Visual Studio /GS flag, Fedora/Red Hat FORTIFY_SOURCE GCC flag, StackGuard, and ProPolice, which provide various mechanisms including canary-based detection and range/index checking. D3-SFCV (Stack Frame Canary Validation) from D3FEND discusses canary-based detection in detail.
  • Use an abstraction library to abstract away risky APIs. Not a complete solution.
  • Implement and perform bounds checking on input.

More Stack-based Buffer Overflow vulnerabilities (CWE-121)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: yes, technical impact: total).
  3. Record last changed materially (score, affected products, status or references).

References

Other vulnerabilities in Certain HP LaserJet Pro, HP LaserJet Enterprise, HP LaserJet Managed Printers

All Certain HP LaserJet Pro, HP LaserJet Enterprise, HP LaserJet Managed Printers vulnerabilities

Recent Stack-based Buffer Overflow vulnerabilities

Spotted an error? Tell us.