CVE-2026-4480

Samba passes a client-controlled print job description string to the command configured in the 'print command' setting using the '%J' substitution character. The problem is that shell meta characters are neither removed nor escaped before substitution. A remote attacker can send a specially crafted print job containing embedded shell special characters, resulting in the Samba server executing arbitrary system commands in the context of the printing process handler.

An attacker can gain remote control over the system (RCE), including reading and modifying data, installing software, and potentially escalating privileges. The scope of the breach includes confidentiality, integrity, and availability of the system at a critical level.

Apply patches available from the vendor according to the references: Red Hat has provided fixes in errata RHSA-2026:22644 and RHSA-2026:22963. As a workaround, until the patch is implemented, it is recommended to disable printing functionality in Samba or remove the 'print command' directive from the configuration if printing is not required.

Samba (printing subsystem) and products integrating Samba: Red Hat OpenShift Container Platform, Red Hat Enterprise Linux — specific versions indicated in vendor references (errata RHSA-2026:22644 and RHSA-2026:22963)