PT-2026-43256 · Samba+2 · Samba+2

Arjun Basnet + 2 · Published 2026-05-26 · Updated 2026-06-06 · CVE-2026-4480

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Samba versions prior to 4.22.10 Samba versions prior to 4.23.8 Samba versions prior to 4.24.3

Description A flaw exists in the Samba printing subsystem where the software passes a client-controlled job description string to the command configured in the "print command" setting using the %J substitution character. Because shell meta characters are not properly escaped, a remote unauthenticated attacker can send a specially crafted print job description containing unescaped shell characters to execute arbitrary code on the affected system.

Recommendations Update to version 4.22.10. Update to version 4.23.8. Update to version 4.24.3. As a temporary workaround, remove %J from the "print command" configurations in the smb.conf file.

Fix

RCE

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

ALSA-2026:22644

ALSA-2026:22963

BDU:2026-07317

CVE-2026-4480

ECHO-A229-4B9E-B030

OPENSUSE-SU-2026:10884-1

USN-8306-1

Affected Products

Linuxmint

Samba

Ubuntu

References · 60

• https://ubuntu.com/security/CVE-2026-1933 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10884-1 · Vendor Advisory
• https://osv.dev/vulnerability/ALSA-2026:22963 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-4408 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:22963 · Vendor Advisory
• https://osv.dev/vulnerability/ALSA-2026:22644 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2026-22644.html · Vendor Advisory
• https://errata.almalinux.org/10/ALSA-2026-22963.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-4480 · Security Note
• https://osv.dev/vulnerability/ALPINE-CVE-2026-4480 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-8306-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-4480 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-07317 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-4480 · Vendor Advisory
• https://bugzilla.samba.org/show_bug.cgi?id=16033 · Vendor Advisory