# CVE-2026-4480: Samba remote code execution in printing subsystem

Source: https://junglewise.ai/threats/cve-2026-4480-samba-remote-code-execution-in-printing-subsystem  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-26. Updated: 2026-05-26  
License: CC BY 4.0 with a link back

CVE-2026-4480 · Severity: high · CVSS 8.5 · Published 2026-05-26

Samba, a widely used software suite for file and print sharing between Windows and Linux systems, contains a vulnerability in its printing subsystem. An attacker can send a specially crafted print job description containing malicious commands that the server will execute. This could allow an unauthorized user to take complete control of the server, potentially leading to data theft or service disruption.

Technologies: [Samba](https://junglewise.ai/threats/technologies/samba). Vendors: [Samba](https://junglewise.ai/threats/vendors/samba).

## Quick answers

**Is CVE-2026-4480 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-4480 being exploited in the wild.

**How severe is CVE-2026-4480?** High severity, with a CVSS score of 8.5, published 26 May 2026.

**Which products and versions are affected?** Samba 4.1 and newer.

**Is there a fix for CVE-2026-4480?** A patch was published on 2026-05-26: Fixes resolved in Samba Bugzilla Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-4480 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-4480?** Check whether you run Samba at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An OS command injection vulnerability (CWE-78) exists in the Samba printing subsystem. The flaw occurs because Samba passes client-controlled job description strings to the system's 'print command' using the '%J' substitution character without properly escaping shell meta-characters. A remote attacker with permission to submit print jobs can exploit this by providing a job description containing unescaped shell characters (e.g., pipes or semicolons). This results in the execution of arbitrary commands with the privileges of the Samba process. The vulnerability affects Samba versions 4.1 and newer; patches have been developed for versions 4.21 through 4.24 and the master branch.

## Affected products

- Samba Samba 4.1 and newer

## Timeline

- 2026-03-15: other: Vulnerability reported to Samba maintainers
- 2026-03-27: disclosed: Initial Red Hat bug report created (embargoed)
- 2026-05-26: advisory: Public disclosure and CVE assignment
- 2026-05-26: patched: Fixes resolved in Samba Bugzilla

## References

- [https://access.redhat.com/security/cve/CVE-2026-4480](https://access.redhat.com/security/cve/CVE-2026-4480)
- [https://bugzilla.redhat.com/show_bug.cgi?id=2452232](https://bugzilla.redhat.com/show_bug.cgi?id=2452232)
- [https://bugzilla.samba.org/show_bug.cgi?id=16033](https://bugzilla.samba.org/show_bug.cgi?id=16033)

## Related threats

- [Samba access control bypass in vfs_ceph_rgw](https://junglewise.ai/threats/cve-2026-109411-an-access-control-bypass-flaw-was-found-in-samba-s-vfs-ceph-rgw)
- [A flaw was found in Samba's CTDB, the clustered database service used by Samba. Insufficient integrity validation of…](https://junglewise.ai/threats/cve-2026-58224-a-flaw-was-found-in-samba-s-ctdb-the-clustered-database-service)
- [Samba AD DC LDAP filter injection and ACL bypass in Compare requests](https://junglewise.ai/threats/cve-2026-58222-samba-ad-dc-ldap-filter-injection-and-acl-bypass-in-compare)
- [Samba KDC out-of-bounds read in kpasswd service](https://junglewise.ai/threats/cve-2026-58216-samba-kdc-out-of-bounds-read-in-kpasswd-service)
- [Samba internal DNS server denial of service via TKEY cache exhaustion](https://junglewise.ai/threats/cve-2026-58218-samba-internal-dns-server-denial-of-service-via-tkey-cache)