Quick answers
- Is CVE-2026-7836 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-7836 being exploited in the wild.
- How severe is CVE-2026-7836?
- Low severity, with a CVSS score of 3.1, published 21 May 2026.
- Which products and versions are affected?
- Netatalk 2.0.0 through 4.4.2.
- Is there a fix for CVE-2026-7836?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-7836 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-7836?
- Check whether you run Netatalk at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A vulnerability exists in the hextoint macro within Netatalk versions 2.0.0 through 4.4.2 due to an 'uppercase bug' (CWE-682). The macro fails to correctly compute values for uppercase hexadecimal characters during filename conversion. An authenticated attacker with network access could potentially trigger this by using specific hexadecimal escapes in filenames, leading to filename corruption or lookup inconsistencies. The attack complexity is high and the impact is limited to data integrity (incorrect file naming/mapping) without providing a path to code execution or privilege escalation. The issue is resolved in version 4.5.0.
Affected products
- Netatalk Netatalk 2.0.0 through 4.4.2
Timeline
- 2026-05-13: disclosed: Initial disclosure date
- 2026-05-21: advisory: NVD and vendor advisory published