CVE-2026-45699

Netatalk has Integer Underflow → Stack Buffer Overflow in copydir()

Netatalk is a Free and Open Source file server suite for Unix-like operating systems. In versions 3.1.19 through 4.4.2, a stack-based buffer overflow exists in the copydir() function of Netatalk's afpd daemon due to an integer underflow in the calculation of the remaining buffer size used for path construction. copydir() is a utility function called when a file operation crosses a device boundary inside an AFP shared volume, which the standard library's renameat() cannot handle. The function attempts to track available buffer space using srem and drem for source and destination paths. Incorrect arithmetic causes both srem and drem to underflow to SIZE_MAX. Consequently, boundary checks against strlen(de->d_name) always pass, allowing strcpy() to append filenames into nearly full stack buffers. Version 4.4.3 patches the issue. As a workaround, configure each AFP shared volume to be structured as a single file system, in other words no subdirectory of a shared volume should be a mount point for a different file system.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Netatalk

Products

Netatalk

CVE-2026-45698

Netatalk has Integer Underflow → Stack Buffer Overflow in deletedir()

Netatalk is a Free and Open Source file server suite for Unix-like operating systems. In versions 3.1.19 through 4.4.2, a stack-based buffer overflow exists in the deletedir() function of Netatalk's afpd daemon due to an integer underflow in the calculation of the remaining buffer size used for path construction. deletedir() is a utility function called when a file operation crosses a device boundary inside an AFP shared volume, which the standard library's renameat() cannot handle. The function attempts to prevent buffer overflows by tracking available space in a size_t remain variable. However, the arithmetic used to compute remain results in an unsigned integer underflow, causing the variable to become SIZE_MAX. Because of this, the subsequent boundary check always evaluates as safe, allowing an unbounded strcpy() operation to copy attacker-controlled filenames into a nearly full stack buffer. Version 4.4.3 patches the issue.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Netatalk

Products

Netatalk

CVE-2026-44072

system() after failed chdir()

Netatalk 2.2.1 through 4.4.2 calls system() after a failed chdir() without properly handling the error condition, which allows a local privileged user to execute unintended commands or cause a minor service disruption under specific conditions.

CVSS 3.1 · 2.5 Low EPSS < 1% KEV · Not listed

Vendors

Netatalk

Products

Netatalk

CVE-2026-44069

Integer underflow in volxlate

An integer underflow in the volxlate function in Netatalk 3.0.0 through 4.4.2 allows a local privileged user to obtain limited information, modify limited data, or cause a minor service disruption via crafted volume translation input.

CVSS 3.1 · 3.4 Low EPSS < 1% KEV · Not listed

Vendors

Netatalk

Products

Netatalk

CVE-2026-44070

Unbounded realloc in charset conversion

An unbounded memory reallocation in the charset conversion code in Netatalk 2.0.0 through 4.4.2 allows a remote authenticated attacker to cause a minor denial of service via crafted character conversion requests.

CVSS 3.1 · 3.1 Low EPSS < 1% KEV · Not listed

Vendors

Netatalk

Products

Netatalk

CVE-2026-44075

Missing break in DSI OpenSession

A missing break statement in DSI OpenSession processing in Netatalk 1.5.0 through 4.4.2 causes a DSIOPT_ATTNQUANT switch case to fall through into DSIOPT_SERVQUANT, resulting in unintended session option handling that may allow a remote attacker to cause a minor service disruption via crafted DSI session options.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed

Vendors

Netatalk

Products

Netatalk

CVE-2026-7837

TOCTOU with root privilege in ad_flush

A time-of-check time-of-use (TOCTOU) condition in the ad_flush function in Netatalk 3.0.0 through 4.4.2 involves root-privileged file operations, which may allow a remote attacker to cause limited data modification under specific race conditions.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed

Vendors

Netatalk

Products

Netatalk

CVE-2026-44067

EA header parsing heap over-read

A heap over-read in extended attribute (EA) header parsing in Netatalk 2.1.0 through 4.4.2 allows a remote authenticated attacker to obtain limited information or cause a minor service disruption via crafted EA data.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed

Vendors

Netatalk

Products

Netatalk

CVE-2026-44066

Heap out-of-bounds reads in Spotlight RPC unmarshalling

Multiple heap out-of-bounds reads in the Spotlight RPC unmarshalling code in Netatalk 3.1.0 through 4.4.2 allow a remote authenticated attacker to obtain sensitive information or cause a minor service disruption.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Netatalk

Products

Netatalk

CVE-2026-44065

Off-by-two in papd lp_write()

An off-by-two error in lp_write() in papd in Netatalk 2.0.0 through 4.4.2 allows an adjacent network attacker to modify limited data or cause a minor service disruption via crafted print data.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed

Vendors

Netatalk

Products

Netatalk

CVE-2026-44064

ASP session ID out-of-bounds access

An out-of-bounds read in ASP session ID handling in Netatalk 1.3 through 4.4.2 allows an adjacent network attacker to obtain limited information or cause a denial of service via a crafted ASP request.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Netatalk

Products

Netatalk

CVE-2026-44068

EA path traversal via incomplete sanitization

Incomplete sanitization of extended attribute (EA) path components in Netatalk 2.1.0 through 4.4.2 allows a remote authenticated attacker to write to files outside the intended metadata namespace via crafted EA names.

CVSS 3.1 · 7.6 High EPSS < 1% KEV · Not listed

Vendors

Netatalk

Products

Netatalk

CVE-2026-44062

Missing o_len bounds check in pull_charset_flags()

A missing output length bounds check in pull_charset_flags() in Netatalk 2.0.4 through 4.4.2 allows a remote authenticated attacker to execute arbitrary code or cause a denial of service via crafted character set data.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Netatalk

Products

Netatalk

CVE-2026-44061

DES-ECB auth with timing side channel

Netatalk 1.5.0 through 4.4.2 uses DES-ECB for authentication with a timing side channel, which allows a remote attacker to recover authentication credentials via timing analysis.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Netatalk

Products

Netatalk

CVE-2026-44060

Integer underflow in dsi_writeinit() leads to denial of service

An integer underflow in dsi_writeinit() in Netatalk 1.5.0 through 4.4.2 allows a remote unauthenticated attacker to cause a denial of service via a crafted DSI write request.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Netatalk

Products

Netatalk

CVE-2026-44052

LDAP simple-bind password exposure in log output

Netatalk 2.1.0 through 4.4.2 inserts LDAP simple-bind passwords into log output in cleartext, which allows an attacker with access to the log files to obtain LDAP credentials.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Netatalk

Products

Netatalk

CVE-2026-44063

LDAP filter injection

An LDAP injection vulnerability in Netatalk 2.1.0 through 4.4.2 allows a remote authenticated attacker to manipulate LDAP queries and obtain limited information or modify LDAP entries via crafted filter input.

CVSS 3.1 · 4.2 Medium EPSS < 1% KEV · Not listed

Vendors

Netatalk

Products

Netatalk

CVE-2026-44050

Heap buffer overflow in CNID daemon comm_rcv()

A heap-based buffer overflow in the CNID daemon comm_rcv() function in Netatalk 2.0.0 through 4.4.2 allows a remote authenticated attacker to execute arbitrary code with escalated privileges or cause a denial of service.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed

Vendors

Netatalk

Products

Netatalk

CVE-2026-44049

Out-of-bounds write in convert_charset() null termination

An out-of-bounds write due to improper null termination in convert_charset() in Netatalk 2.0.4 through 4.4.2 allows a remote authenticated attacker to execute arbitrary code or cause a denial of service via crafted character data.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Netatalk

Products

Netatalk

CVE-2026-44048

Stack buffer overflow via UCS-2 type confusion in convert_charset()

A stack-based buffer overflow via UCS-2 type confusion in convert_charset() in Netatalk 2.0.4 through 4.4.2 allows a remote authenticated attacker to execute arbitrary code or cause a denial of service.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Netatalk

Products

Netatalk