Executive brief
HP Easy Start is an installer utility for HP printer software on macOS. A vulnerability in the Uninstaller component allows a local attacker to create symbolic links in predictable temporary directories; when an authorized administrator runs the uninstaller, it writes log files through the symlink as root, allowing an attacker to corrupt or create files with elevated privileges.
Technical details
CVE-2026-12555 is a privilege escalation vulnerability stemming from insecure temporary file handling (CWE-379). The HP Uninstaller component uses a hardcoded, predictable path (/tmp/com.hp.uninstaller-log.txt) for logging and a static UUID in /private/tmp for lock files. These paths are opened without validating symlinks while the Ruby script runs as root via AppleScript administrative elevation. An unprivileged local attacker can pre-create symbolic links at these locations pointing to any file; when an authorized user runs the uninstaller and approves the privilege elevation prompt, the application follows the symlink and writes log content or acquires file locks as root. This creates a privileged file-write/corruption primitive. The attack requires local filesystem access and user-initiated administrative action but does not require the attacker to control file content or forge credentials. HP addressed this in version 2.16.7.260722.
Affected products
- HP Easy Start for macOS prior to 2.16.7.260722
Timeline
- 2026-09: disclosed: Cipher Security Labs published research identifying CVE-2026-12555 and related vulnerabilities
- 2026-07-29: patched: HP released version 2.16.7.260722 with remediation
- 2026-08-24: advisory: CVE-2026-12555 published; HP advisory HPSBPI04124 issued