Vulnerability · Published May 26, 2026 · Assigned by redhat

CVE-2026-4480Samba: samba: remote code execution in printing subsystem via unescaped job description

Critical 9.0

In plain English

A critical-severity OS command injection in Red Hat Enterprise Linux 10 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 13.9% (higher than 97% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei, public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)9.0Critical

Exploit odds (30 days)13.9%top 3.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling2Nuclei, Public PoC

Official description

A flaw was found in the Samba printing subsystem. Samba passes the client-controlled job description string to the command configured with the "print command" setting via the "%J" substitution character without escaping shell meta characters. A remote attacker could exploit this vulnerability by sending a specially crafted print job description that contains unescaped shell characters. This could lead to remote code execution on the affected system.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
AlmaLinux:8	ctdb	4.19.4-16.el8_10	ALSA-2026:22644
AlmaLinux:10	ldb-tools	4.23.5-109.el10_2	ALSA-2026:22963
AlmaLinux:9	ldb-tools	4.23.5-10.el9_8	ALSA-2026:25049
AlmaLinux:10	libldb	4.23.5-109.el10_2	ALSA-2026:22963
AlmaLinux:9	libldb	4.23.5-10.el9_8	ALSA-2026:25049
AlmaLinux:10	libldb-devel	4.23.5-109.el10_2	ALSA-2026:22963
AlmaLinux:9	libldb-devel	4.23.5-10.el9_8	ALSA-2026:25049
AlmaLinux:10	libnetapi	4.23.5-109.el10_2	ALSA-2026:22963
AlmaLinux:8	libnetapi	4.19.4-16.el8_10	ALSA-2026:22644
AlmaLinux:9	libnetapi	4.23.5-10.el9_8	ALSA-2026:25049
AlmaLinux:10	libnetapi-devel	4.23.5-109.el10_2	ALSA-2026:22963
AlmaLinux:8	libnetapi-devel	4.19.4-16.el8_10	ALSA-2026:22644
AlmaLinux:9	libnetapi-devel	4.23.5-10.el9_8	ALSA-2026:25049
AlmaLinux:10	libsmbclient	4.23.5-109.el10_2	ALSA-2026:22963
AlmaLinux:8	libsmbclient	4.19.4-16.el8_10	ALSA-2026:22644
AlmaLinux:9	libsmbclient	4.23.5-10.el9_8	ALSA-2026:25049
AlmaLinux:10	libsmbclient-devel	4.23.5-109.el10_2	ALSA-2026:22963
AlmaLinux:8	libsmbclient-devel	4.19.4-16.el8_10	ALSA-2026:22644
AlmaLinux:9	libsmbclient-devel	4.23.5-10.el9_8	ALSA-2026:25049
AlmaLinux:10	libwbclient	4.23.5-109.el10_2	ALSA-2026:22963
AlmaLinux:8	libwbclient	4.19.4-16.el8_10	ALSA-2026:22644
AlmaLinux:9	libwbclient	4.23.5-10.el9_8	ALSA-2026:25049
AlmaLinux:10	libwbclient-devel	4.23.5-109.el10_2	ALSA-2026:22963
AlmaLinux:8	libwbclient-devel	4.19.4-16.el8_10	ALSA-2026:22644
AlmaLinux:9	libwbclient-devel	4.23.5-10.el9_8	ALSA-2026:25049
AlmaLinux:10	python3-ldb	4.23.5-109.el10_2	ALSA-2026:22963
AlmaLinux:9	python3-ldb	4.23.5-10.el9_8	ALSA-2026:25049
AlmaLinux:10	python3-samba	4.23.5-109.el10_2	ALSA-2026:22963
AlmaLinux:8	python3-samba	4.19.4-16.el8_10	ALSA-2026:22644
AlmaLinux:9	python3-samba	4.23.5-10.el9_8	ALSA-2026:25049
AlmaLinux:10	python3-samba-dc	4.23.5-109.el10_2	ALSA-2026:22963
AlmaLinux:8	python3-samba-dc	4.19.4-16.el8_10	ALSA-2026:22644
AlmaLinux:9	python3-samba-dc	4.23.5-10.el9_8	ALSA-2026:25049
AlmaLinux:8	python3-samba-devel	4.19.4-16.el8_10	ALSA-2026:22644
AlmaLinux:10	python3-samba-test	4.23.5-109.el10_2	ALSA-2026:22963
AlmaLinux:8	python3-samba-test	4.19.4-16.el8_10	ALSA-2026:22644
AlmaLinux:9	python3-samba-test	4.23.5-10.el9_8	ALSA-2026:25049
AlmaLinux:10	samba	4.23.5-109.el10_2	ALSA-2026:22963
AlmaLinux:8	samba	4.19.4-16.el8_10	ALSA-2026:22644
AlmaLinux:9	samba	4.23.5-10.el9_8	ALSA-2026:25049
AlmaLinux:10	samba-client	4.23.5-109.el10_2	ALSA-2026:22963
AlmaLinux:8	samba-client	4.19.4-16.el8_10	ALSA-2026:22644
AlmaLinux:9	samba-client	4.23.5-10.el9_8	ALSA-2026:25049
AlmaLinux:10	samba-client-libs	4.23.5-109.el10_2	ALSA-2026:22963
AlmaLinux:8	samba-client-libs	4.19.4-16.el8_10	ALSA-2026:22644
AlmaLinux:9	samba-client-libs	4.23.5-10.el9_8	ALSA-2026:25049
AlmaLinux:10	samba-common	4.23.5-109.el10_2	ALSA-2026:22963
AlmaLinux:8	samba-common	4.19.4-16.el8_10	ALSA-2026:22644
AlmaLinux:9	samba-common	4.23.5-10.el9_8	ALSA-2026:25049
AlmaLinux:10	samba-common-libs	4.23.5-109.el10_2	ALSA-2026:22963
AlmaLinux:8	samba-common-libs	4.19.4-16.el8_10	ALSA-2026:22644
AlmaLinux:9	samba-common-libs	4.23.5-10.el9_8	ALSA-2026:25049
AlmaLinux:10	samba-common-tools	4.23.5-109.el10_2	ALSA-2026:22963
AlmaLinux:8	samba-common-tools	4.19.4-16.el8_10	ALSA-2026:22644
AlmaLinux:9	samba-common-tools	4.23.5-10.el9_8	ALSA-2026:25049
AlmaLinux:10	samba-dc-libs	4.23.5-109.el10_2	ALSA-2026:22963
AlmaLinux:8	samba-dc-libs	4.19.4-16.el8_10	ALSA-2026:22644
AlmaLinux:9	samba-dc-libs	4.23.5-10.el9_8	ALSA-2026:25049
AlmaLinux:10	samba-dcerpc	4.23.5-109.el10_2	ALSA-2026:22963
AlmaLinux:8	samba-dcerpc	4.19.4-16.el8_10	ALSA-2026:22644
AlmaLinux:9	samba-dcerpc	4.23.5-10.el9_8	ALSA-2026:25049
AlmaLinux:10	samba-devel	4.23.5-109.el10_2	ALSA-2026:22963
AlmaLinux:8	samba-devel	4.19.4-16.el8_10	ALSA-2026:22644
AlmaLinux:9	samba-devel	4.23.5-10.el9_8	ALSA-2026:25049
AlmaLinux:10	samba-gpupdate	4.23.5-109.el10_2	ALSA-2026:22963
AlmaLinux:9	samba-gpupdate	4.23.5-10.el9_8	ALSA-2026:25049
AlmaLinux:10	samba-krb5-printing	4.23.5-109.el10_2	ALSA-2026:22963
AlmaLinux:8	samba-krb5-printing	4.19.4-16.el8_10	ALSA-2026:22644
AlmaLinux:9	samba-krb5-printing	4.23.5-10.el9_8	ALSA-2026:25049
AlmaLinux:10	samba-ldb-ldap-modules	4.23.5-109.el10_2	ALSA-2026:22963
AlmaLinux:8	samba-ldb-ldap-modules	4.19.4-16.el8_10	ALSA-2026:22644
AlmaLinux:9	samba-ldb-ldap-modules	4.23.5-10.el9_8	ALSA-2026:25049
AlmaLinux:10	samba-libs	4.23.5-109.el10_2	ALSA-2026:22963
AlmaLinux:8	samba-libs	4.19.4-16.el8_10	ALSA-2026:22644
AlmaLinux:9	samba-libs	4.23.5-10.el9_8	ALSA-2026:25049
AlmaLinux:10	samba-pidl	4.23.5-109.el10_2	ALSA-2026:22963
AlmaLinux:8	samba-pidl	4.19.4-16.el8_10	ALSA-2026:22644
AlmaLinux:9	samba-pidl	4.23.5-10.el9_8	ALSA-2026:25049
AlmaLinux:10	samba-test	4.23.5-109.el10_2	ALSA-2026:22963
AlmaLinux:8	samba-test	4.19.4-16.el8_10	ALSA-2026:22644
AlmaLinux:9	samba-test	4.23.5-10.el9_8	ALSA-2026:25049
AlmaLinux:10	samba-test-libs	4.23.5-109.el10_2	ALSA-2026:22963
AlmaLinux:8	samba-test-libs	4.19.4-16.el8_10	ALSA-2026:22644
AlmaLinux:9	samba-test-libs	4.23.5-10.el9_8	ALSA-2026:25049
AlmaLinux:10	samba-tools	4.23.5-109.el10_2	ALSA-2026:22963
AlmaLinux:8	samba-tools	4.19.4-16.el8_10	ALSA-2026:22644
AlmaLinux:9	samba-tools	4.23.5-10.el9_8	ALSA-2026:25049
AlmaLinux:10	samba-usershares	4.23.5-109.el10_2	ALSA-2026:22963
AlmaLinux:8	samba-usershares	4.19.4-16.el8_10	ALSA-2026:22644
AlmaLinux:9	samba-usershares	4.23.5-10.el9_8	ALSA-2026:25049
AlmaLinux:10	samba-vfs-iouring	4.23.5-109.el10_2	ALSA-2026:22963
AlmaLinux:8	samba-vfs-iouring	4.19.4-16.el8_10	ALSA-2026:22644
AlmaLinux:9	samba-vfs-iouring	4.23.5-10.el9_8	ALSA-2026:25049
AlmaLinux:10	samba-winbind	4.23.5-109.el10_2	ALSA-2026:22963
AlmaLinux:8	samba-winbind	4.19.4-16.el8_10	ALSA-2026:22644
AlmaLinux:9	samba-winbind	4.23.5-10.el9_8	ALSA-2026:25049
AlmaLinux:10	samba-winbind-clients	4.23.5-109.el10_2	ALSA-2026:22963
AlmaLinux:8	samba-winbind-clients	4.19.4-16.el8_10	ALSA-2026:22644
AlmaLinux:9	samba-winbind-clients	4.23.5-10.el9_8	ALSA-2026:25049
AlmaLinux:10	samba-winbind-krb5-locator	4.23.5-109.el10_2	ALSA-2026:22963
AlmaLinux:8	samba-winbind-krb5-locator	4.19.4-16.el8_10	ALSA-2026:22644
AlmaLinux:9	samba-winbind-krb5-locator	4.23.5-10.el9_8	ALSA-2026:25049
AlmaLinux:10	samba-winbind-modules	4.23.5-109.el10_2	ALSA-2026:22963
AlmaLinux:8	samba-winbind-modules	4.19.4-16.el8_10	ALSA-2026:22644
AlmaLinux:9	samba-winbind-modules	4.23.5-10.el9_8	ALSA-2026:25049
AlmaLinux:10	samba-winexe	4.23.5-109.el10_2	ALSA-2026:22963
AlmaLinux:8	samba-winexe	4.19.4-16.el8_10	ALSA-2026:22644
AlmaLinux:9	samba-winexe	4.23.5-10.el9_8	ALSA-2026:25049
Alpine:v3.23	samba	4.22.10-r0	ALPINE-CVE-2026-4480
Alpine:v3.24	samba	4.23.8-r0	ALPINE-CVE-2026-4480
Debian:12	samba	2:4.17.12+dfsg-0+deb12u4	DEBIAN-CVE-2026-4480
Debian:13	samba	2:4.22.8+dfsg-0+deb13u2	DEBIAN-CVE-2026-4480
Debian:14	samba	2:4.24.3+dfsg-1	DEBIAN-CVE-2026-4480
Rocky Linux:10	samba	0:4.23.5-109.el10_2	RLSA-2026:22963
Rocky Linux:8	samba	0:4.19.4-16.el8_10	RLSA-2026:22644
Rocky Linux:9	samba	0:4.23.5-10.el9_8	RLSA-2026:25049
Ubuntu:22.04:LTS	samba	2:4.15.13+dfsg-0ubuntu1.12	UBUNTU-CVE-2026-4480
Ubuntu:24.04:LTS	samba	2:4.19.5+dfsg-4ubuntu9.6	UBUNTU-CVE-2026-4480
Ubuntu:25.10	samba	2:4.22.3+dfsg-4ubuntu2.4	UBUNTU-CVE-2026-4480
Ubuntu:26.04:LTS	samba	2:4.23.6+dfsg-1ubuntu2.1	UBUNTU-CVE-2026-4480

Affected products (as reported)

Vendor	Product	Versions
Red Hat	Red Hat Enterprise Linux 10	see references
Red Hat	Red Hat Enterprise Linux 10.0 Extended Update Support	see references
Red Hat	Red Hat Enterprise Linux 7 Extended Lifecycle Support	see references
Red Hat	Red Hat Enterprise Linux 7 Extended Lifecycle Support	see references
Red Hat	Red Hat Enterprise Linux 8	see references
Red Hat	Red Hat Enterprise Linux 8	see references
Red Hat	Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support	see references
Red Hat	Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On	see references
Red Hat	Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support	see references
Red Hat	Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On	see references
Red Hat	Red Hat Enterprise Linux 8.8 Telecommunications Update Service	see references
Red Hat	Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions	see references
Red Hat	Red Hat Enterprise Linux 9	see references
Red Hat	Red Hat Enterprise Linux 9	see references
Red Hat	Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions	see references
Red Hat	Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions	see references
Red Hat	Red Hat Enterprise Linux 9.6 Extended Update Support	see references
Red Hat	Red Hat Enterprise Linux 6	see references
Red Hat	Red Hat Enterprise Linux 6	see references
Red Hat	Red Hat OpenShift Container Platform 4	see references
Red Hat	Red Hat OpenShift Container Platform 4	see references

Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

References

RHSA-2026:22644 vendor-advisory, x_refsource_REDHAT
RHSA-2026:22963 vendor-advisory, x_refsource_REDHAT
RHSA-2026:25049 vendor-advisory, x_refsource_REDHAT
RHSA-2026:25979 vendor-advisory, x_refsource_REDHAT
RHSA-2026:28053 vendor-advisory, x_refsource_REDHAT
RHSA-2026:28054 vendor-advisory, x_refsource_REDHAT
RHSA-2026:28055 vendor-advisory, x_refsource_REDHAT
RHSA-2026:28056 vendor-advisory, x_refsource_REDHAT
RHSA-2026:28057 vendor-advisory, x_refsource_REDHAT
RHSA-2026:28058 vendor-advisory, x_refsource_REDHAT
RHSA-2026:28132 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2026-4480 vdb-entry, x_refsource_REDHAT
RHBZ#2452232 issue-tracking, x_refsource_REDHAT
https://bugzilla.samba.org/show_bug.cgi?id=16033
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4480.json x_sadp-csaf-vex