Executive brief
HP Easy Start is HP's software installer for printer drivers and utilities on macOS. A local attacker with access to a shared Mac can exploit insecure temporary file handling in the uninstaller component to write files with administrative privileges to arbitrary locations, potentially leading to system compromise or credential theft. This requires the attacker to be on the same system and requires a user to approve an elevation prompt.
Technical details
CVE-2026-12554 is one of three related vulnerabilities affecting HP Easy Start's software-delivery pipeline. This particular CVE relates to an unmaintained third-party download stack (CWE-1104) used during software installation. The vulnerability involves predictable temporary file paths in the HP Uninstaller component (/tmp/com.hp.uninstaller-log.txt and /private/tmp/ with a static UUID) that are accessed while running with administrative privileges without symlink validation. A local unprivileged user can create symbolic links at these predictable paths before the elevated process attempts to open them, causing privileged writes to attacker-chosen file locations. The attack requires local access and user authorization of an administrative prompt, but enables privilege escalation. HP released version 2.16.7.260722 which remediates all three CVEs.
Affected products
- HP Inc. Easy Start for macOS prior to 2.16.7.260722
Timeline
- 2026-09: disclosed: Cipher Security Labs published advisory
- 2026-07-29: patched: HP released version 2.16.7.260722
- 2026-08-24: other: NVD entry published