# CVE-2026-44062: Netatalk out-of-bounds write in pull_charset_flags

Source: https://junglewise.ai/threats/cve-2026-44062-netatalk-out-of-bounds-write-in-pull-charset-flags  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-21. Updated: 2026-05-21  
License: CC BY 4.0 with a link back

CVE-2026-44062 · Severity: high · CVSS 7.5 · Published 2026-05-21

Netatalk is an open-source implementation of the Apple Filing Protocol (AFP), allowing Unix-like systems to serve as file servers for macOS clients. A security flaw in how the software handles file and path names during character set conversion could allow a logged-in user to corrupt system memory. This could potentially lead to a complete system takeover or service instability, though the attack requires specific conditions to be met.

Technologies: [Netatalk](https://junglewise.ai/threats/technologies/netatalk). Vendors: [Netatalk](https://junglewise.ai/threats/vendors/netatalk).

## Quick answers

**Is CVE-2026-44062 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-44062 being exploited in the wild.

**How severe is CVE-2026-44062?** High severity, with a CVSS score of 7.5, published 21 May 2026.

**Which products and versions are affected?** Netatalk 2.0.4 through 4.4.2.

**Is there a fix for CVE-2026-44062?** A patch was published on 2026-05-21: Fix released in version 4.4.3 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-44062 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-44062?** Check whether you run Netatalk at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An out-of-bounds write vulnerability (CWE-787) exists in Netatalk versions 2.0.4 through 4.4.2. The flaw is located in the `pull_charset_flags()` function, where a missing `o_len` bounds check allows a two-byte sequence to be written after the remaining output length has underflowed. An authenticated attacker can trigger this by providing specially crafted filename or path data that forces unusual conversion states. While the attack vector is network-based, it requires low-privilege authentication and carries high complexity due to the specific memory states required for exploitation. Successful exploitation could lead to arbitrary code execution or a denial-of-service condition. The issue is resolved in version 4.4.3.

## Affected products

- Netatalk Netatalk 2.0.4 through 4.4.2

## Timeline

- 2026-05-13: disclosed: Initial disclosure date
- 2026-05-21: advisory: NVD publication date
- 2026-05-21: patched: Fix released in version 4.4.3

## References

- [https://netatalk.io/security/CVE-2026-44062](https://netatalk.io/security/CVE-2026-44062)

## Related threats

- [Netatalk afpd stack buffer overflow in deletedir()](https://junglewise.ai/threats/cve-2026-45698-netatalk-afpd-stack-buffer-overflow-in-deletedir)
- [Netatalk afpd stack buffer overflow in copydir()](https://junglewise.ai/threats/cve-2026-45699-netatalk-afpd-stack-buffer-overflow-in-copydir)
- [Netatalk TOCTOU race condition in ad_flush](https://junglewise.ai/threats/cve-2026-7837-netatalk-toctou-race-condition-in-ad-flush)
- [Netatalk missing break statement in DSI OpenSession](https://junglewise.ai/threats/cve-2026-44075-netatalk-missing-break-statement-in-dsi-opensession)
- [Netatalk incorrect calculation in ACL error handling](https://junglewise.ai/threats/cve-2026-44074-netatalk-incorrect-calculation-in-acl-error-handling)