CVE-2026-4682
Received Received - Intake
Buffer Overflow in HP DeskJet WSD Scan Enables Remote Code Execution

Publication date: 2026-04-15

Last updated on: 2026-04-15

Assigner: HP Inc.

Description
Certain HP DeskJet All in One devices may be vulnerable to remote code execution caused by a buffer overflow when specially crafted Web Services for Devices (WSD) scan requests are improperly validated and handled by the MFP. WSD Scan is a Microsoft Windows–based network scanning protocol that allows a PC to discover scanners (and MFPs) on a network and send scan jobs to them without requiring vendor specific drivers or utilities.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-04-15
Last Modified
2026-04-15
Generated
2026-06-16
AI Q&A
2026-04-15
EPSS Evaluated
2026-06-15
NVD
CVE-2026-4682
EUVD
EUVD-2026-22949
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
hp deskjet_all_in_one *
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-121 A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability affects certain HP DeskJet All in One devices and is caused by a buffer overflow. It occurs when specially crafted Web Services for Devices (WSD) scan requests are improperly validated and handled by the multifunction printer (MFP).

WSD Scan is a Microsoft Windows–based network scanning protocol that allows a PC to discover scanners and MFPs on a network and send scan jobs to them without needing vendor-specific drivers or utilities.

Due to improper validation of these WSD scan requests, an attacker could exploit this buffer overflow to execute remote code on the affected device.

Impact Analysis

This vulnerability can allow an attacker to remotely execute code on the affected HP DeskJet All in One devices. Remote code execution can lead to unauthorized control over the device, potentially allowing the attacker to manipulate device functions, access sensitive information, or use the device as a foothold to attack other systems on the network.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-4682. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart