# CVE-2026-44056: Netatalk stack buffer overflow in desktop.c

Source: https://junglewise.ai/threats/cve-2026-44056-netatalk-stack-buffer-overflow-in-desktop-c  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-21. Updated: 2026-05-21  
License: CC BY 4.0 with a link back

CVE-2026-44056 · Severity: medium · CVSS 6.4 · Published 2026-05-21

Netatalk is an open-source implementation of the Apple Filing Protocol (AFP) that allows Unix-like systems to serve files to macOS clients. A security flaw in how the software handles file metadata could allow a user with login credentials to crash the file sharing service. While the risk of data theft is low, an attacker could disrupt business operations by causing a denial of service on the file server.

Technologies: [Netatalk](https://junglewise.ai/threats/technologies/netatalk). Vendors: [Netatalk](https://junglewise.ai/threats/vendors/netatalk).

## Quick answers

**Is CVE-2026-44056 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-44056 being exploited in the wild.

**How severe is CVE-2026-44056?** Medium severity, with a CVSS score of 6.4, published 21 May 2026.

**Which products and versions are affected?** Netatalk 1.3 through 4.2.2.

**Is there a fix for CVE-2026-44056?** A patch was published on 2026-05-21: Fixed in version 4.5.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-44056 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-44056?** Check whether you run Netatalk at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A stack-based buffer overflow (CWE-121) exists in the desktop.c component of Netatalk versions 1.3 through 4.2.2. The vulnerability occurs when a directory entry name is appended to a fixed-size stack buffer without proper bounds checking during desktop metadata processing. An authenticated attacker with network access can trigger this overflow by providing unusually long metadata entry names. While the primary impact is a denial of service (service crash), there is a theoretical risk of limited data exposure or integrity loss. The issue is fixed in version 4.5.0; users on older versions can apply a source patch or restrict AFP write access as a workaround.

## Affected products

- Netatalk Netatalk 1.3 through 4.2.2

## Timeline

- 2026-05-13: disclosed: Initial disclosure date reported by vendor
- 2026-05-21: advisory: NVD publication date
- 2026-05-21: patched: Fixed in version 4.5.0

## References

- [https://netatalk.io/security/CVE-2026-44056](https://netatalk.io/security/CVE-2026-44056)

## Related threats

- [Netatalk afpd stack buffer overflow in deletedir()](https://junglewise.ai/threats/cve-2026-45698-netatalk-afpd-stack-buffer-overflow-in-deletedir)
- [Netatalk afpd stack buffer overflow in copydir()](https://junglewise.ai/threats/cve-2026-45699-netatalk-afpd-stack-buffer-overflow-in-copydir)
- [Netatalk TOCTOU race condition in ad_flush](https://junglewise.ai/threats/cve-2026-7837-netatalk-toctou-race-condition-in-ad-flush)
- [Netatalk missing break statement in DSI OpenSession](https://junglewise.ai/threats/cve-2026-44075-netatalk-missing-break-statement-in-dsi-opensession)
- [Netatalk incorrect calculation in ACL error handling](https://junglewise.ai/threats/cve-2026-44074-netatalk-incorrect-calculation-in-acl-error-handling)