Description
Netatalk is a Free and Open Source file server suite for Unix-like operating systems. In versions 3.1.19 through 4.4.2, a stack-based buffer overflow exists in the copydir() function of Netatalk's afpd daemon due to an integer underflow in the calculation of the remaining buffer size used for path construction. copydir() is a utility function called when a file operation crosses a device boundary inside an AFP shared volume, which the standard library's renameat() cannot handle. The function attempts to track available buffer space using srem and drem for source and destination paths. Incorrect arithmetic causes both srem and drem to underflow to SIZE_MAX. Consequently, boundary checks against strlen(de->d_name) always pass, allowing strcpy() to append filenames into nearly full stack buffers. Version 4.4.3 patches the issue. As a workaround, configure each AFP shared volume to be structured as a single file system, in other words no subdirectory of a shared volume should be a mount point for a different file system.
Published: 2026-08-14
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Netatalk, a file server suite for Unix-like systems, contains a stack-based buffer overflow in the copydir() function of its afpd daemon. The flaw is caused by an integer underflow that corrupts the calculation of remaining buffer space for source and destination paths. When a file operation crosses a device boundary inside an AFP shared volume, the underflow sets the internal buffer limits to SIZE_MAX, causing boundary checks on the file name length to always succeed and enabling strcpy() to overrun a near‑full stack buffer. This flaw satisfies CWE‑191 and CWE‑120 and can lead to arbitrary code execution with the privileges of the afpd daemon.

Affected Systems

The affected product is Netatalk, versions 3.1.19 through 4.4.2 contain the vulnerable copydir() implementation. The vulnerability is fixed in Netatalk 4.4.3 and later releases.

Risk and Exploitability

The CVSS score of 7.5 denotes high severity. The EPSS score of < 1% indicates a very low but non‑zero probability of exploitation, and the issue is not listed in the CISA KEV catalog. The most likely attack vector is through malicious file operations that cross a mounted file system boundary within an AFP shared volume, which an attacker who can invoke AFP operations on the target system may trigger. Successful exploitation could corrupt stack memory and allow arbitrary code execution with the privileges of the afpd daemon.

Generated by OpenCVE AI on August 18, 2026 at 04:13 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply Netatalk 4.4.3 or later, which patches the buffer overflow
  • If an upgrade is not immediately possible, reconfigure each AFP shared volume so that no subdirectory is a mount point for a different file system, thereby preventing copydir() from operating across device boundaries
  • If neither upgrade nor reconfiguration can be performed, consider disabling the afpd daemon or blocking AFP protocol access from untrusted hosts until a patch or configuration change is applied

Generated by OpenCVE AI on August 18, 2026 at 04:13 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DSA Debian DSA DSA-62801 netatalk security update
History

Tue, 18 Aug 2026 03:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 18 Aug 2026 00:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-120
References
Metrics threat_severity

None

 threat_severity

Important

Fri, 14 Aug 2026 21:00:00 +0000

Type Values Removed Values Added
First Time appeared Netatalk
Netatalk netatalk
Vendors & Products Netatalk
Netatalk netatalk

Fri, 14 Aug 2026 19:15:00 +0000

Type Values Removed Values Added
Description Netatalk is a Free and Open Source file server suite for Unix-like operating systems. In versions 3.1.19 through 4.4.2, a stack-based buffer overflow exists in the copydir() function of Netatalk's afpd daemon due to an integer underflow in the calculation of the remaining buffer size used for path construction. copydir() is a utility function called when a file operation crosses a device boundary inside an AFP shared volume, which the standard library's renameat() cannot handle. The function attempts to track available buffer space using srem and drem for source and destination paths. Incorrect arithmetic causes both srem and drem to underflow to SIZE_MAX. Consequently, boundary checks against strlen(de->d_name) always pass, allowing strcpy() to append filenames into nearly full stack buffers. Version 4.4.3 patches the issue. As a workaround, configure each AFP shared volume to be structured as a single file system, in other words no subdirectory of a shared volume should be a mount point for a different file system.
Title Netatalk has Integer Underflow → Stack Buffer Overflow in copydir()
Weaknesses CWE-191
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Netatalk Netatalk
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-08-18T02:13:41.161Z

Reserved: 2026-05-13T04:38:01.165Z

Link: CVE-2026-45699

cve-icon Vulnrichment

Updated: 2026-08-18T02:13:37.318Z

cve-icon NVD

Status : Received

Published: 2026-08-14T19:17:18.267

Modified: 2026-08-18T02:17:26.850

Link: CVE-2026-45699

cve-icon Redhat

Severity : Important

Publid Date: 2026-08-14T19:05:46Z

Links: CVE-2026-45699 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-18T04:15:04Z

Weaknesses
  • CWE-120

    Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

  • CWE-191

    Integer Underflow (Wrap or Wraparound)