Critical Remote Code Execution Vulnerability Discovered in Samba Printing Subsystem (CVE-2026-4480)

A high-severity security flaw has been identified within the Samba printing subsystem that could allow an unauthenticated attacker to achieve full Remote Code Execution (RCE). Tracked as CVE-2026-4480, this vulnerability has been assigned a maximum CVSS score of 10.0, signifying a critical risk to the confidentiality, integrity, and availability of the host system.

The vulnerability is rooted in how Samba processes user-supplied input within specific print configurations. It specifically impacts Samba print servers where the print command directive is utilized in conjunction with the %J substitution parameter. Because Samba serves as a backbone for file and print sharing across countless enterprise and Linux-based environments, the potential blast radius of this flaw is extensive.

Technical Analysis: Command Injection via Shell Metacharacters

The core of the issue lies in a failure to properly sanitize and escape shell metacharacters when processing the %J substitution. In Samba’s architecture, the %J parameter is intended to represent the print job ID. However, the subsystem takes the client-controlled job description string and passes it directly to a system shell command without sufficient validation.

An attacker can exploit this by submitting a specially crafted print job containing malicious shell commands embedded within the job description. When the server attempts to execute the configured print command, it inadvertently executes the attacker’s injected payload with the privileges of the Samba process. This risk is significantly amplified in environments where guest printing is enabled by default, as it allows an attacker to trigger the exploit without needing valid credentials.

Scope of Impact and Configuration Nuances

It is important to note that this vulnerability is not universal to all Samba installations. The risk is highly dependent on the specific configuration of the smb.conf file:

• Vulnerable: Servers utilizing custom or legacy print command settings that include the %J parameter.
• Not Vulnerable: Systems configured to use printing = cups or printing = iprint, as these drivers handle job processing through different, more secure pipelines.

While some administrators have attempted to mitigate this by wrapping the parameter in single quotes (e.g., '%J'), this is not a definitive fix. Sophisticated attackers may still find ways to inject malicious command-line arguments that bypass simple quote encapsulation, making this a “defense-in-depth” measure rather than a true patch.

Remediation and Patching Strategy

The Samba development team has moved quickly to address this critical flaw. To secure your environment, you should prioritize upgrading to the following patched versions:

• Samba 4.22.10
• Samba 4.23.8
• Samba 4.24.3

For detailed technical advisories and download links, please refer to the official Samba Security page.

Interim Workarounds

If immediate patching is not an option due to operational constraints, the following temporary mitigations are recommended:

1. Locate the print command setting in your smb.conf and remove the %J substitution entirely.
2. Disable guest printing to increase the barrier to entry for unauthenticated attackers.

These workarounds should only be viewed as stop-gap measures. The only verified method to eliminate the vulnerability is to apply the official security updates.

This vulnerability was brought to light through the diligent research of security professionals from SafeBreach, ZeroPath, and Securin Labs. The subsequent patch development was a coordinated effort involving the Samba development team and contributors from Sernet and Catalyst.

Given the widespread deployment of Samba in mission-critical networks, security administrators are urged to audit their print service configurations and implement patches immediately to prevent unauthorized remote access.