Description
Netatalk is a Free and Open Source file server suite for Unix-like operating systems. In versions 3.1.19 through 4.4.2, a stack-based buffer overflow exists in the copydir() function of Netatalk's afpd daemon due to an integer underflow in the calculation of the remaining buffer size used for path construction. copydir() is a utility function called when a file operation crosses a device boundary inside an AFP shared volume, which the standard library's renameat() cannot handle. The function attempts to track available buffer space using srem and drem for source and destination paths. Incorrect arithmetic causes both srem and drem to underflow to SIZE_MAX. Consequently, boundary checks against strlen(de->d_name) always pass, allowing strcpy() to append filenames into nearly full stack buffers. Version 4.4.3 patches the issue. As a workaround, configure each AFP shared volume to be structured as a single file system, in other words no subdirectory of a shared volume should be a mount point for a different file system.
Published: 2026-08-14
Score: 7.5 High
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Netatalk, a file server suite for Unix-like systems, contains a stack-based buffer overflow in the copydir() function of its afpd daemon. The flaw is caused by an integer underflow that corrupts the calculation of remaining buffer space for source and destination paths. When a file operation crosses a device boundary inside an AFP shared volume, the underflow sets the internal buffer limits to SIZE_MAX, causing boundary checks on the file name length to always succeed and enabling strcpy() to overrun a near-full stack buffer. This flaw satisfies CWE‑191 and can lead to arbitrary code execution with the privileges of the afpd daemon.

Affected Systems

The affected product is Netatalk (netatalk:netatalk). Versions 3.1.19 through 4.4.2 contain the vulnerable copydir() implementation. The vulnerability is fixed in Netatalk 4.4.3 and later releases.

Risk and Exploitability

The CVSS score of 7.5 denotes high severity. No EPSS score is available, and the issue is not listed in the CISA KEV catalog. The most likely attack vector is through malicious file operations that cross a mounted file system boundary within an AFP shared volume, which an attacker who can invoke AFP operations on the target system may trigger. Successful exploitation could corrupt stack memory and allow arbitrary code execution with the privileges of the afpd daemon.

Generated by OpenCVE AI on August 14, 2026 at 21:05 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply Netatalk 4.4.3 or later, which patches the buffer overflow
  • If an upgrade is not immediately possible, reconfigure each AFP shared volume so that no subdirectory is a mount point for a different file system, thereby preventing copydir() from operating across device boundaries
  • If neither upgrade nor reconfiguration can be performed, consider disabling the afpd daemon or blocking AFP protocol access from untrusted hosts until a patch or configuration change is applied

Generated by OpenCVE AI on August 14, 2026 at 21:05 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DSA Debian DSA DSA-62801 netatalk security update
History

Fri, 14 Aug 2026 21:00:00 +0000

Type Values Removed Values Added
First Time appeared Netatalk
Netatalk netatalk
Vendors & Products Netatalk
Netatalk netatalk

Fri, 14 Aug 2026 19:15:00 +0000

Type Values Removed Values Added
Description Netatalk is a Free and Open Source file server suite for Unix-like operating systems. In versions 3.1.19 through 4.4.2, a stack-based buffer overflow exists in the copydir() function of Netatalk's afpd daemon due to an integer underflow in the calculation of the remaining buffer size used for path construction. copydir() is a utility function called when a file operation crosses a device boundary inside an AFP shared volume, which the standard library's renameat() cannot handle. The function attempts to track available buffer space using srem and drem for source and destination paths. Incorrect arithmetic causes both srem and drem to underflow to SIZE_MAX. Consequently, boundary checks against strlen(de->d_name) always pass, allowing strcpy() to append filenames into nearly full stack buffers. Version 4.4.3 patches the issue. As a workaround, configure each AFP shared volume to be structured as a single file system, in other words no subdirectory of a shared volume should be a mount point for a different file system.
Title Netatalk has Integer Underflow → Stack Buffer Overflow in copydir()
Weaknesses CWE-191
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Netatalk Netatalk
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-08-14T19:06:22.102Z

Reserved: 2026-05-13T04:38:01.165Z

Link: CVE-2026-45699

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-14T19:17:18.267

Modified: 2026-08-14T19:17:18.267

Link: CVE-2026-45699

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-14T21:15:06Z

Weaknesses
  • CWE-191

    Integer Underflow (Wrap or Wraparound)