Log in Start free

Vulnerability · Published Apr 15, 2026 · Assigned by hp

CVE-2026-4682Certain HP DeskJet All In One (AIO) Devices – Potential Remote Code Execution & Potential Buffer Overflow

High 8.7

In plain English

A high-severity stack buffer overflow in HP DeskJet 2800e All-in-One Printer series from HP Inc. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 23% of all known vulnerabilities).

Severity (CVSS 4.0)8.7High
Exploit odds (30 days)0.3%top 77.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Certain HP DeskJet All in One devices may be vulnerable to remote code execution caused by a buffer overflow when specially crafted Web Services for Devices (WSD) scan requests are improperly validated and handled by the MFP. WSD Scan is a Microsoft Windows–based network scanning protocol that allows a PC to discover scanners (and MFPs) on a network and send scan jobs to them without requiring vendor specific drivers or utilities.

Affected products (as reported)

VendorProductVersions
HP Inc HP DeskJet 2800e All-in-One Printer series 0 – before <2612A
HP Inc HP DeskJet 4200 All-in-One Printer series 0 – before <2612A
HP Inc HP DeskJet Ink Advantage 4200 All-in-One Printer series 0 – before <2612A
HP Inc HP DeskJet 4200e All-in-One Printer series 0 – before <2612A
HP Inc HP DeskJet Ink Advantage Ultra 4900 series 0 – before <2612A
HP Inc HP DeskJet Ink Advantage 2800 All-in-One Printer series 0 – before <2612A

Weakness: CWE-121 · Vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References