carloseduardopm/cve-2026-4480-pocsmb spooler to RCE
Proof-of-concept and research material related to CVE-2026-4480, a critical Remote Code Execution (RCE) vulnerability affecting the Samba printing subsystem.
The vulnerability is caused by improper handling of user-controlled print job descriptions passed to the configured print command through the %J substitution parameter.
According to the Samba security advisory, the issue occurs because shell metacharacters are not properly escaped when client-controlled job descriptions are processed through the %J substitution variable.
Systems may be vulnerable when:
print command option is used%J substitution parameter is present in the commandConfigurations using:
printing = cupsprinting = iprintare not affected according to the Samba advisory.
The vulnerability allows an attacker to influence data passed to the printing subsystem.
Improper sanitization of the print job description may result in shell command injection when the print command is executed by Samba.
Successful exploitation can lead to arbitrary command execution in the context of the printing service.
Recommended mitigations include:
%J from print commandThis repository was developed for:
This project is provided strictly for educational and research purposes.
Do not test against systems without explicit authorization.
The author assumes no responsibility for misuse of this material.
Carlos Eduardo P. Meireles
Security Researcher | CTF Player | Member of HackersOnSteroids