Executive brief
Netatalk is a file server suite that provides AFP (Apple Filing Protocol) file sharing on Unix-like systems. An authenticated attacker can exploit a stack buffer overflow in the afpd daemon to crash the service or potentially execute arbitrary code by providing specially crafted filenames during file operations that cross filesystem boundaries.
Technical details
The vulnerability is a stack-based buffer overflow in the deletedir() function of Netatalk's afpd daemon, caused by an integer underflow in the calculation of the remaining buffer size. The function tracks available space in a size_t remain variable to prevent buffer overflows; however, the arithmetic (strlen(path) - len - 1) results in an unsigned integer underflow that sets remain to SIZE_MAX. This causes the subsequent boundary check (strlen(de->d_name) > remain) to always evaluate false, allowing an unbounded strcpy() operation to write attacker-controlled filenames into a nearly full stack buffer. The vulnerability is triggered when file operations cross device boundaries within an AFP shared volume. An authenticated attacker can provide a NAME_MAX (255 byte) filename to overflow the stack buffer by up to 253 bytes, potentially overwriting return addresses for remote code execution or reliably crashing the afpd daemon. Version 4.4.3 patches the issue; versions 3.1.19 through 4.4.2 are affected.
Affected products
- Netatalk Netatalk 3.1.19 through 4.4.2
Timeline
- 2026-05-28: disclosed
- 2026-05-13: patched: Version 4.4.3 released with fix
- 2026-08-17: published