CVE-2026-4682
Buffer Overflow in HP DeskJet WSD Scan Enables Remote Code Execution
Publication date: 2026-04-15
Last updated on: 2026-04-15
Assigner: HP Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| hp | deskjet_all_in_one | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-121 | A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function). |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability affects certain HP DeskJet All in One devices and is caused by a buffer overflow. It occurs when specially crafted Web Services for Devices (WSD) scan requests are improperly validated and handled by the multifunction printer (MFP).
WSD Scan is a Microsoft Windows–based network scanning protocol that allows a PC to discover scanners and MFPs on a network and send scan jobs to them without needing vendor-specific drivers or utilities.
Due to improper validation of these WSD scan requests, an attacker could exploit this buffer overflow to execute remote code on the affected device.
How can this vulnerability impact me? :
This vulnerability can allow an attacker to remotely execute code on the affected HP DeskJet All in One devices. Remote code execution can lead to unauthorized control over the device, potentially allowing the attacker to manipulate device functions, access sensitive information, or use the device as a foothold to attack other systems on the network.