Executive brief
Netatalk is an open-source implementation of the Apple Filing Protocol (AFP), allowing Unix-like systems to serve as file servers for macOS clients. A security flaw in how the software handles file and path names during character set conversion could allow a logged-in user to corrupt system memory. This could potentially lead to a complete system takeover or service instability, though the attack requires specific conditions to be met.
Technical details
An out-of-bounds write vulnerability (CWE-787) exists in Netatalk versions 2.0.4 through 4.4.2. The flaw is located in the `pull_charset_flags()` function, where a missing `o_len` bounds check allows a two-byte sequence to be written after the remaining output length has underflowed. An authenticated attacker can trigger this by providing specially crafted filename or path data that forces unusual conversion states. While the attack vector is network-based, it requires low-privilege authentication and carries high complexity due to the specific memory states required for exploitation. Successful exploitation could lead to arbitrary code execution or a denial-of-service condition. The issue is resolved in version 4.4.3.
Affected products
- Netatalk Netatalk 2.0.4 through 4.4.2
Timeline
- 2026-05-13: disclosed: Initial disclosure date
- 2026-05-21: advisory: NVD publication date
- 2026-05-21: patched: Fix released in version 4.4.3