CVE-2026-4682
Received Received - Intake

Buffer Overflow in HP DeskJet WSD Scan Enables Remote Code Execution

Publication date: 2026-04-15

Last updated on: 2026-04-15

Assigner: HP Inc.

Description
Certain HP DeskJet All in One devices may be vulnerable to remote code execution caused by a buffer overflow when specially crafted Web Services for Devices (WSD) scan requests are improperly validated and handled by the MFP. WSD Scan is a Microsoft Windows–based network scanning protocol that allows a PC to discover scanners (and MFPs) on a network and send scan jobs to them without requiring vendor specific drivers or utilities.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-04-15
Last Modified
2026-04-15
Generated
2026-07-06
AI Q&A
2026-04-15
EPSS Evaluated
2026-07-05
NVD
CVE-2026-4682
EUVD
EUVD-2026-22949

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
hp deskjet_all_in_one *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-121 A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects certain HP DeskJet All in One devices and is caused by a buffer overflow. It occurs when specially crafted Web Services for Devices (WSD) scan requests are improperly validated and handled by the multifunction printer (MFP).

WSD Scan is a Microsoft Windows–based network scanning protocol that allows a PC to discover scanners and MFPs on a network and send scan jobs to them without needing vendor-specific drivers or utilities.

Due to improper validation of these WSD scan requests, an attacker could exploit this buffer overflow to execute remote code on the affected device.

Impact Analysis

This vulnerability can allow an attacker to remotely execute code on the affected HP DeskJet All in One devices. Remote code execution can lead to unauthorized control over the device, potentially allowing the attacker to manipulate device functions, access sensitive information, or use the device as a foothold to attack other systems on the network.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-4682. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart