Paper/Archive/CVE-2026-4480

CVE-2026-4480

Red Hat Red Hat Enterprise Linux 10 — Samba: samba: remote code execution in printing subsystem via unescaped job description

EPSS 14%CVSS 9.0

critical.is priorityof 100

CVSS 9.0 (CNA)9.0 / 10 × 3027.0 Not in CISA KEV+300.0 EPSS percentile 96.5.965 × 2019.3 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

A flaw was found in the Samba printing subsystem. Samba passes the client-controlled job description string to the command configured with the "print command" setting via the "%J" substitution character without escaping shell meta characters. A remote attacker could exploit this vulnerability by sending a specially crafted print job description that contains unescaped shell characters. This could lead to remote code execution on the affected system.

Affected

ProductAffectedFixed inSource

Red Hat Enterprise Linux 10see advisory0:4.23.5-109.el10_2CNA

Red Hat Enterprise Linux 10.0 Extended Update Supportsee advisory0:4.21.3-114.el10_0.1CNA

Red Hat Enterprise Linux 7 Extended Lifecycle Supportsee advisory0:4.10.16-26.el7_9.1CNA

Red Hat Enterprise Linux 8see advisory0:4.19.4-16.el8_10CNA

Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Supportsee advisory0:4.13.3-12.el8_4.1CNA

Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-Onsee advisory0:4.13.3-12.el8_4.1CNA

Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Supportsee advisory0:4.15.5-16.el8_6.1CNA

Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-Onsee advisory0:4.15.5-16.el8_6.1CNA

Red Hat Enterprise Linux 8.8 Telecommunications Update Servicesee advisory0:4.17.5-7.el8_8.1CNA

Red Hat Enterprise Linux 8.8 Update Services for SAP Solutionssee advisory0:4.17.5-7.el8_8.1CNA

Scores by source

redhat (CNA)9.0CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

redhat-SADP (CNA)9.0CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References