CVE-2026-4480— Samba: samba: remote code execution in printing subsystem via unescaped job description
In-the-Wild Activity Observed github_trending · low
Possible ATT&CK Techniques 1AI
T1059 · Command and Scripting InterpreterAffected Version Matrix 20
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-4480
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Samba: samba: remote code execution in printing subsystem via unescaped job description
Source: CVE Program / CVE List V5
Vulnerability Description
A flaw was found in the Samba printing subsystem. Samba passes the client-controlled job description string to the command configured with the "print command" setting via the "%J" substitution character without escaping shell meta characters. A remote attacker could exploit this vulnerability by sending a specially crafted print job description that contains unescaped shell characters. This could lead to remote code execution on the affected system.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
OS命令中使用的特殊元素转义处理不恰当(OS命令注入)
Source: CVE Program / CVE List V5
Vulnerability Title
Samba 操作系统命令注入漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Samba是Samba开源的一个适用于 Linux 和 Unix 的标准 Windows 互操作性程序套件。 Samba存在操作系统命令注入漏洞，该漏洞源于将客户端控制的作业描述字符串传递给打印命令时未转义shell元字符，可能导致远程攻击者通过特制打印作业描述执行远程代码。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | 0:4.23.5-109.el10_2 ~ * | cpe:/o:redhat:enterprise_linux:10.2 | |
| Red Hat | Red Hat Enterprise Linux 10.0 Extended Update Support | 0:4.21.3-114.el10_0.1 ~ * | cpe:/o:redhat:enterprise_linux_eus:10.0 | |
| Red Hat | Red Hat Enterprise Linux 7 Extended Lifecycle Support | 0:4.10.16-26.el7_9.1 ~ * | cpe:/o:redhat:enterprise_linux:7::server | |
| Red Hat | Red Hat Enterprise Linux 7 Extended Lifecycle Support | 0:4.10.16-26.el7_9.1 ~ * | cpe:/o:redhat:enterprise_linux:7::server | |
| Red Hat | Red Hat Enterprise Linux 8 | 0:4.19.4-16.el8_10 ~ * | cpe:/a:redhat:enterprise_linux:8::appstream | |
| Red Hat | Red Hat Enterprise Linux 8 | 0:4.19.4-16.el8_10 ~ * | cpe:/a:redhat:enterprise_linux:8::appstream | |
| Red Hat | Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support | 0:4.13.3-12.el8_4.1 ~ * | cpe:/o:redhat:rhel_aus:8.4::baseos | |
| Red Hat | Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On | 0:4.13.3-12.el8_4.1 ~ * | cpe:/o:redhat:rhel_aus:8.4::baseos | |
| Red Hat | Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support | 0:4.15.5-16.el8_6.1 ~ * | cpe:/a:redhat:rhel_aus:8.6::appstream | |
| Red Hat | Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On | 0:4.15.5-16.el8_6.1 ~ * | cpe:/a:redhat:rhel_aus:8.6::appstream | |
| Red Hat | Red Hat Enterprise Linux 8.8 Telecommunications Update Service | 0:4.17.5-7.el8_8.1 ~ * | cpe:/a:redhat:rhel_e4s:8.8::appstream | |
| Red Hat | Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions | 0:4.17.5-7.el8_8.1 ~ * | cpe:/a:redhat:rhel_e4s:8.8::appstream | |
| Red Hat | Red Hat Enterprise Linux 9 | 0:4.23.5-10.el9_8 ~ * | cpe:/a:redhat:enterprise_linux:9::appstream | |
| Red Hat | Red Hat Enterprise Linux 9 | 0:4.23.5-10.el9_8 ~ * | cpe:/a:redhat:enterprise_linux:9::appstream | |
| Red Hat | Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions | 0:4.17.5-105.el9_2.5 ~ * | cpe:/a:redhat:rhel_e4s:9.2::appstream | |
| Red Hat | Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions | 0:4.19.4-105.el9_4.4 ~ * | cpe:/a:redhat:rhel_e4s:9.4::appstream | |
| Red Hat | Red Hat Enterprise Linux 9.6 Extended Update Support | 0:4.21.3-14.el9_6.1 ~ * | cpe:/a:redhat:rhel_eus:9.6::appstream | |
| Red Hat | Red Hat Enterprise Linux 6 | - | cpe:/o:redhat:enterprise_linux:6 | |
| Red Hat | Red Hat Enterprise Linux 6 | - | cpe:/o:redhat:enterprise_linux:6 | |
| Red Hat | Red Hat OpenShift Container Platform 4 | - | cpe:/a:redhat:openshift:4 |
II. Public POCs for CVE-2026-4480
| # | POC Description | Source Link | Shenlong Link |
|---|---|---|---|
| 1 | A flaw was found in the Samba printing subsystem. Samba passes the client-controlled job description string to the command configured with the "print command" setting via the "%J" substitution character without escaping shell meta characters. A remote attacker could exploit this vulnerability by sending a specially crafted print job description that contains unescaped shell characters. This could lead to remote code execution on the affected system. | https://github.com/projectdiscovery/nuclei-templates/blob/main/javascript/cves/2026/CVE-2026-4480.yaml | POC Details |
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-4480
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-4480 (1)
Vendor Advisories for CVE-2026-4480 (3)
- 🔗 RHSA-2026:22963 - Security Advisory - Red Hat Customer Portal Read full article vendor-advisoryx_refsource_REDHAT
Other References for CVE-2026-4480 (9)
Same Patch Batch · Red Hat · 2026-05-26 · 7 CVEs total
| CVE-2026-7374 | 9.9 CRITICAL | Kubevirt: kubevirt virt-handler: privilege escalation and node compromise via symlink foll |
| CVE-2026-5260 | 8.2 HIGH | Gnutls: gnutls: information disclosure via heap overread in rsa key exchange |
| CVE-2026-42013 | 8.2 HIGH | Gnutls: gnutls: certificate validation bypass due to oversized subject alternative name |
| CVE-2026-48864 | 7.8 HIGH | Libsolv: heap buffer overflow in libsolv repopagestore via unchecked decompression of mali |
| CVE-2026-42012 | 7.1 HIGH | Gnutls: gnutls: certificate validation bypass due to improper handling of uri and srv sans |
| CVE-2026-42015 | 5.3 MEDIUM | Gnutls: gnutls: memory corruption due to off-by-one error in pkcs#12 bag handling |
IV. Related Vulnerabilities
Same product: Red Hat Enterprise Linux 10
- CVE-2026-13002
Dnsmasq: infinite loop dos in dnssec nsec/nsec3 type bitmap - CVE-2026-58224
Samba: ctdb fails to do integrity checking of received packe - CVE-2026-19617
Libdm: lvm2: libdm: denial of service via uncontrolled recur - CVE-2026-73584
Sblim-sfcb: sblim-sfcb: privileged file corruption and denia - CVE-2026-73583
Sblim-sfcb: unsafe deserialization in sblim-sfcb provider-ma
Same vendor: Red Hat
- CVE-2026-66792
Multicloud-operators-subscription: multicloud-operators-subs - CVE-2026-15218
Models-as-a-service: red hat openshift ai: maas-api and maas - CVE-2026-74247
Quay: ssrf via build archive_url in quay build api - CVE-2026-74245
Quay: unauthenticated exported logs download in quay - CVE-2026-74244
Quay: stripe webhook accepts forged events without signature
Same weakness: CWE-78
- CVE-2026-68519
Glances: `--disable-config-exec` does not cover on-alert act - CVE-2026-62982
Glances: Incomplete fix of CVE-2026-32608: action-template s - CVE-2026-68518
Glances: Command injection bypass of action-template sanitiz - CVE-2026-75056
IntelliJ IDEA 远程代码执行漏洞 - CVE-2026-71567
User-controlled variables inserted unescaped into shell scri
V. Comments for CVE-2026-4480
No comments yet