This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.
[TLP:CLEAR] HP LaserJet fixes 3 vulnerabilities in its devices
HP fixes 3 vulnerabilities in HP LaserJet Pro, HP LaserJet Enterprise and HP LaserJet Managed printers. An overview of all vulnerable devices and their fixes can be found at [1]. The relevant fixed firmware is available for download at [2].
Due to a stack buffer overflow when processing a PostScript print job, an unauthenticated remote attacker can execute code or escalate their privileges [3].
CVSS: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
More information:
- CVE-2025-26506 at cve.org, NVD
- CWE-121: Stack-based Buffer Overflow at cwe.mitre.org
The vulnerability was publicly disclosed 14. 2. 2025.
Due to an out-of-bounds write when processing a PostScript print job, an unauthenticated remote attacker can execute code or escalate their privileges [4].
CVSS: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N
More information:
- CVE-2025-26508 at cve.org, NVD
- CWE-787: Out-of-bounds Write at cwe.mitre.org
The vulnerability was publicly disclosed 14. 2. 2025.
Due to a stack buffer overflow when processing a PostScript print job, an unauthenticated remote attacker can execute code or escalate their privileges [5].
CVSS: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
More information:
- CVE-2025-26507 at cve.org, NVD
- CWE-121: Stack-based Buffer Overflow at cwe.mitre.org
The vulnerability was publicly disclosed 14. 2. 2024.
Links
By CESNET, z.s.p.o. Michaela Ručková on 4. 3. 2025.