ZDI-CAN-28366: ZDI-26-280: (Pwn2Own) HP DeskJet 2855e JobStatusEvent Stack-based Buffer Overflow Remote Code Execution Vulnerability

Published Apr 15, 2026

Updated

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of HP DeskJet 2855e printers. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.8. The following CVEs are assigned: CVE-2026-4682.

Affected Software

1 affected component

HP DeskJet 2855e

Event History

Apr 15, 2026

Advisory Published

via ZDI·05:00 AM

Data Sourced

via ZDI·05:00 AM

Description

Frequently Asked Questions

What is the severity of ZDI-CAN-28366?

ZDI-CAN-28366 has a critical severity rating due to the potential for remote code execution.

How do I fix ZDI-CAN-28366?

To fix ZDI-CAN-28366, update the firmware of your HP DeskJet 2855e printer to the latest version available from HP.

Who is affected by ZDI-CAN-28366?

ZDI-CAN-28366 affects users of the HP DeskJet 2855e printer model.

Can ZDI-CAN-28366 be exploited remotely?

Yes, ZDI-CAN-28366 can be exploited by network-adjacent attackers without the need for authentication.

What type of vulnerability is ZDI-CAN-28366?

ZDI-CAN-28366 is a stack-based buffer overflow vulnerability that allows for arbitrary code execution.