Netatalk’s CNID daemon contains a heap buffer overflow in the comm_rcv() function. A heap-based buffer overflow in comm_rcv() in Netatalk 2.0.0 through 4.4.2 allows a remote authenticated attacker to execute arbitrary code with escalated privileges or cause a denial of service. The vulnerability is classified as a classic buffer overflow flaw (CWE-122).

The problem affects Netatalk versions 2.0.0 through 4.4.2. The vendor identified the entry as Netatalk. The flaw is fixed in release 4.4.3 and newer versions.

The CVSS score of 9.9 reflects the severity of the flaw. EPSS information is not available, and the issue is not listed in CISA’s KEV catalog. Because Netatalk is a network‑accessible daemon, the likely attack vector is remote exploitation via crafted packets sent to the CNID service by an authenticated attacker; a successful exploit would grant the attacker full system privileges, enabling arbitrary code execution or denial of service. The vulnerability is a classic buffer overflow (CWE-122).