Executive brief
Netatalk is an open-source implementation of the Apple Filing Protocol (AFP) used to share files between Unix-like systems and macOS. A security flaw in how the software handles file path translations could lead to memory errors if a system administrator uses an unusually long or malformed configuration value. Because the vulnerability requires high-level administrative privileges to exploit, the practical risk to most organizations is low.
Technical details
An integer underflow (CWE-191) exists in the volxlate component of Netatalk versions 3.0.0 through 4.4.2. The vulnerability occurs during path translation when the software subtracts the length of formatted output from the remaining destination buffer size without proper validation. An attacker with high-level administrative privileges (PR:H) could potentially trigger this underflow by providing specially crafted, long configuration values or volume paths. This could lead to a buffer overflow or memory corruption, though exploitability is considered low due to the requirement for local access and administrative control over configuration files. The issue is resolved in Netatalk version 4.5.0.
Affected products
- Netatalk Netatalk 3.0.0 through 4.4.2
Timeline
- 2026-05-13: disclosed: Initial disclosure date
- 2026-05-21: advisory: NVD publication date
- 2026-05-21: patched: Fixed in version 4.5.0