Race Condition Vulnerability in PaperCut MF Affecting HP Multifunction Devices

CVE-2026-6180

What is CVE-2026-6180?

A race condition in PaperCut MF arises when processing badge-swipe data from specific HP multifunction devices. This issue occurs under certain network conditions where packet loss and out-of-order sequence counters take place. As a result, the server may misprocess fragmented data, leading to a potentially serious security situation. If a sequence reset notification does not reach the server, initial data chunks may be rejected, while incorrectly accepted subsequent chunks can result in a truncated badge ID string. In environments with customized post-processing scripts for badge IDs, this truncated string can mistakenly be transformed into a valid ID for another user, causing unauthorized session access and incorrect user logins.

References