Quick answers
- Is CVE-2026-45698 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-45698 being exploited in the wild.
- How severe is CVE-2026-45698?
- High severity, with a CVSS score of 7.5, published 17 August 2026.
- Which products and versions are affected?
- Netatalk 3.1.19 through 4.4.2.
- Is there a fix for CVE-2026-45698?
- A patch was published on 2026-05-13: Version 4.4.3 released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-45698 attacked?
- It is attacked over the network, in a hosted service.
- Am I affected by CVE-2026-45698?
- Check whether you run Netatalk at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is a stack-based buffer overflow in the deletedir() function of Netatalk's afpd daemon, caused by an integer underflow in the calculation of the remaining buffer size. The function tracks available space in a size_t remain variable to prevent buffer overflows; however, the arithmetic (strlen(path) - len - 1) results in an unsigned integer underflow that sets remain to SIZE_MAX. This causes the subsequent boundary check (strlen(de->d_name) > remain) to always evaluate false, allowing an unbounded strcpy() operation to write attacker-controlled filenames into a nearly full stack buffer. The vulnerability is triggered when file operations cross device boundaries within an AFP shared volume. An authenticated attacker can provide a NAME_MAX (255 byte) filename to overflow the stack buffer by up to 253 bytes, potentially overwriting return addresses for remote code execution or reliably crashing the afpd daemon. Version 4.4.3 patches the issue; versions 3.1.19 through 4.4.2 are affected.
Affected products
- Netatalk Netatalk 3.1.19 through 4.4.2
Timeline
- 2026-05-28: disclosed
- 2026-05-13: patched: Version 4.4.3 released with fix
- 2026-08-17: published