HP ImageDiags CVE-2026-82346

Local access as a low-privileged user account on the target system is required. Active use of HP ImageDiags by a second, higher-privileged user must occur - the CVSS 4.0 UI:A (Active) metric confirms this user-interaction dependency is not passive. Exploitation is limited to HP ImageDiags versions prior to 5.0.0.36. The attack cannot be conducted remotely and does not cross network boundaries. The requirement for concurrent or sequential privileged-user interaction substantially limits exploitation to shared or multi-user workstation environments; single-user endpoints where only the primary user runs ImageDiags are not realistically at risk.

The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N) meaningfully constrains real-world risk: exploitation requires both local shell or physical access as a low-privileged user and concurrent active use of HP ImageDiags by a higher-privileged user on the same machine. The scored severity of 7.0 reflects the high CIA impact to the vulnerable system, but realistic exposure is limited to shared multi-user workstations or kiosk-style IT environments - single-user endpoints are not practically at risk. EPSS data is absent from the provided intelligence, preventing quantitative exploitation-probability assessment. The CVE does not appear in the CISA KEV catalog, and no POC has been identified, indicating no confirmed active exploitation at time of analysis. AC:L indicates that once prerequisites are satisfied, no special timing technique or exploit sophistication is required, which slightly elevates urgency for multi-user shared environments but does not expand the threat surface beyond them. The scope-change metrics (SC:N/SI:N/SA:N) confirm the impact is bounded to the local system with no lateral risk to adjacent systems.

A low-privileged local attacker on a shared HP workstation identifies the temporary file path used by HP ImageDiags, then plants a malicious symlink or file in that location before or during a privileged user's active ImageDiags session. When the diagnostics utility processes the manipulated temporary resource under the elevated user's context, the attacker's payload executes with elevated privileges, granting full control of the local system.