CVE-2026-4682

CVE-2026-4682 is a buffer overflow vulnerability affecting certain HP DeskJet All-in-One multifunction printers (MFPs) that can be exploited through the Windows Web Services for Devices (WSD) scanning protocol. The flaw exists in how these devices validate and process specially crafted WSD scan requests, potentially allowing remote code execution without requiring vendor-specific drivers or utilities. The vulnerability presents a network-based attack vector with moderate risk potential. While complete CVSS metrics are not currently available, the FAUCET Risk Score of 51.0 out of 100 indicates a moderate severity rating. The EPSS score of 0.0005 suggests this vulnerability has a relatively low probability of being exploited compared to the broader CVE landscape, though the accessible network protocol and remote nature of the attack vector warrant attention. There is currently no evidence of active exploitation in the wild, and this vulnerability has not been designated as a Known Exploited Vulnerability (KEV). The inactive Hot List status and minimal EPSS percentile ranking suggest limited community attention and exploit development at this time. Organizations should nonetheless apply patches when available and implement network segmentation controls around MFP devices to mitigate potential exposure.