Executive brief
Netatalk is an open-source implementation of the Apple Filing Protocol (AFP) that allows Unix-like systems to serve files to macOS clients. A security flaw in how the software handles file metadata could allow a user with login credentials to crash the file sharing service. While the risk of data theft is low, an attacker could disrupt business operations by causing a denial of service on the file server.
Technical details
A stack-based buffer overflow (CWE-121) exists in the desktop.c component of Netatalk versions 1.3 through 4.2.2. The vulnerability occurs when a directory entry name is appended to a fixed-size stack buffer without proper bounds checking during desktop metadata processing. An authenticated attacker with network access can trigger this overflow by providing unusually long metadata entry names. While the primary impact is a denial of service (service crash), there is a theoretical risk of limited data exposure or integrity loss. The issue is fixed in version 4.5.0; users on older versions can apply a source patch or restrict AFP write access as a workaround.
Affected products
- Netatalk Netatalk 1.3 through 4.2.2
Timeline
- 2026-05-13: disclosed: Initial disclosure date reported by vendor
- 2026-05-21: advisory: NVD publication date
- 2026-05-21: patched: Fixed in version 4.5.0