Executive brief
Netatalk is an open-source implementation of the Apple Filing Protocol (AFP) that allows Unix-like systems to serve files to macOS clients. A security flaw in how the software handles character set conversion could allow a logged-in user to crash the file sharing service or potentially execute unauthorized code. This could lead to a disruption of file services or unauthorized access to sensitive data on the server.
Technical details
An out-of-bounds write vulnerability (CWE-787) exists in the convert_charset() function of Netatalk versions 2.0.4 through 4.4.2. The flaw occurs during null termination when the converted output exactly fills the caller-supplied destination buffer, causing the function to write two null bytes past the buffer boundary. An authenticated attacker can exploit this over the network to trigger memory corruption, potentially leading to a denial-of-service (process crash) or arbitrary code execution. The attack complexity is considered high as it requires specific conditions during charset conversion. The issue is resolved in Netatalk version 4.4.3.
Affected products
- Netatalk Netatalk 2.0.4 through 4.4.2
Timeline
- 2026-05-13: disclosed
- 2026-05-21: advisory: NVD publication date
- 2026-05-21: patched: Fixed in version 4.4.3