CVE-2026-4480
Critical · 9.0CVSS
9.0
EPSS
13.9%
Published
May 26, 2026
CISA due date
—
The record
A flaw was found in the Samba printing subsystem. Samba passes the client-controlled job description string to the command configured with the "print command" setting via the "%J" substitution character without escaping shell meta characters. A remote attacker could exploit this vulnerability by sending a specially crafted print job description that contains unescaped shell characters. This could lead to remote code execution on the affected system.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Leap 16.0 | samba | 0 | 4.22.9+git.506.22c03ce0781-160000.1.1 |
| openSUSE:Tumbleweed | samba | 0 | 4.23.8+git.477.f78166bceed-1.1 |
Related vulnerabilities
- CVE-2026-3238 A flaw was found in Samba’s WINS server component when running as an Active Directory… Also affects samba
- CVE-2026-4408 A flaw was found in Samba. Also affects samba
- CVE-2026-1933 A flaw was found in Samba’s handling of NTFS-style reparse points on shares configured… Also affects samba
- CVE-2026-2340 A flaw was found in Samba’s vfs_worm module. Also affects samba
- CVE-2026-3012 A flaw was found in Samba’s certificate auto-enrollment Group Policy handling. Also affects samba
- CVE-2025-10230 A flaw was found in Samba, in the front-end WINS hook handling: NetBIOS names from… Also affects samba
- CVE-2026-40170 ngtcp2 is a C implementation of the IETF QUIC protocol. Also affects samba
- CVE-2017-11103 Heimdal before 7.4 allows remote attackers to impersonate services with Orpheus' Lyre… Also affects samba