In Netatalk versions 2.0.4 through 4.4.2, a stack-based buffer overflow is triggered by UCS‑2 type confusion in the convert_charset() function. A remote authenticated attacker can provide crafted UCS‑2 input to overwrite control data on the stack, enabling arbitrary code execution or denial of service. The weakness is a classic stack-based buffer overflow (CWE‑121).

The vulnerability affects the Netatalk file‑sharing suite. Any installation running Netatalk 2.0.4, 3.0.0, 3.2.x, or any 4.4.x release up to 4.4.2 is impacted. Versions 4.4.3 and later contain the fix.

The CVSS score of 8.8 reflects a high severity potential for remote exploitation. No EPSS data is available, and the flaw is not listed in CISA KEV. The exploit requires interaction with the vulnerable Netatalk service and the ability to supply UTF‑16 (UCS‑2) data to the convert_charset() routine. Once triggered, the overflow may grant code execution on the host machine. Given the lack of mitigation in unpatched versions, the risk is significant for networks exposing Netatalk services to untrusted hosts.