CVE-2026-45698
Received Received - Intake

Stack-Based Buffer Overflow in Netatalk afpd Daemon

Publication date: 2026-08-17

Last updated on: 2026-08-17

Assigner: GitHub, Inc.

Description
Netatalk is a Free and Open Source file server suite for Unix-like operating systems. In versions 3.1.19 through 4.4.2, a stack-based buffer overflow exists in the deletedir() function of Netatalk's afpd daemon due to an integer underflow in the calculation of the remaining buffer size used for path construction. deletedir() is a utility function called when a file operation crosses a device boundary inside an AFP shared volume, which the standard library's renameat() cannot handle. The function attempts to prevent buffer overflows by tracking available space in a size_t remain variable. However, the arithmetic used to compute remain results in an unsigned integer underflow, causing the variable to become SIZE_MAX. Because of this, the subsequent boundary check always evaluates as safe, allowing an unbounded strcpy() operation to copy attacker-controlled filenames into a nearly full stack buffer. Version 4.4.3 patches the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-17
Last Modified
2026-08-17
Generated
2026-08-17
AI Q&A
2026-08-17
EPSS Evaluated
N/A
NVD
CVE-2026-45698
EUVD
EUVD-2026-60326

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
netatalk netatalk From 3.1.19 (inc) to 4.4.2 (inc)
netatalk netatalk 4.4.3

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-191 The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a stack-based buffer overflow in Netatalk's afpd daemon caused by an integer underflow in the deletedir() function. When handling file operations across device boundaries in AFP shared volumes, the function incorrectly calculates remaining buffer space due to unsigned arithmetic. This causes the size_t variable 'remain' to underflow to SIZE_MAX, bypassing boundary checks and allowing unbounded strcpy() operations with attacker-controlled filenames.

Detection Guidance

Detecting this vulnerability requires checking the Netatalk version running on your system. Run 'afpd -v' or 'netatalk -v' to check the installed version. If the version is between 3.1.19 and 4.4.2, the system is vulnerable. Additionally, monitor for crashes in the afpd daemon or unusual file operation failures across device boundaries in AFP shared volumes.

Impact Analysis

An attacker with access to an AFP shared volume could exploit this to overwrite stack memory, potentially leading to remote code execution with the privileges of the afpd daemon. At minimum, it could crash the afpd worker process, causing a denial of service. The attack requires authenticated access but no user interaction.

Compliance Impact

This vulnerability could lead to unauthorized access, data breaches, or service disruption, which may violate compliance requirements under GDPR (data protection), HIPAA (health information security), or other regulations mandating data integrity and availability. Unpatched systems risk non-compliance due to potential exposure of sensitive data.

Mitigation Strategies

Upgrade Netatalk to version 4.4.3 or later immediately. If upgrading is not possible, configure AFP shared volumes to use a single file system without mount points for different file systems as a temporary workaround. Ensure no untrusted users have access to AFP shares until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-45698. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart