CVE-2026-45699
Received Received - Intake

Stack-Based Buffer Overflow in Netatalk

Publication date: 2026-08-14

Last updated on: 2026-08-14

Assigner: GitHub, Inc.

Description
Netatalk is a Free and Open Source file server suite for Unix-like operating systems. In versions 3.1.19 through 4.4.2, a stack-based buffer overflow exists in the copydir() function of Netatalk's afpd daemon due to an integer underflow in the calculation of the remaining buffer size used for path construction. copydir() is a utility function called when a file operation crosses a device boundary inside an AFP shared volume, which the standard library's renameat() cannot handle. The function attempts to track available buffer space using srem and drem for source and destination paths. Incorrect arithmetic causes both srem and drem to underflow to SIZE_MAX. Consequently, boundary checks against strlen(de->d_name) always pass, allowing strcpy() to append filenames into nearly full stack buffers. Version 4.4.3 patches the issue. As a workaround, configure each AFP shared volume to be structured as a single file system, in other words no subdirectory of a shared volume should be a mount point for a different file system.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-14
Last Modified
2026-08-14
Generated
2026-08-14
AI Q&A
2026-08-14
EPSS Evaluated
N/A
NVD
CVE-2026-45699
EUVD
EUVD-2026-58790

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
netatalk netatalk From 3.1.19 (inc) to 4.4.2 (inc)
netatalk netatalk 4.4.3

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-191 The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-45699 is a stack-based buffer overflow in Netatalk's afpd daemon affecting versions 3.1.19 through 4.4.2. It occurs in the copydir() function when handling file operations crossing device boundaries in AFP shared volumes. An integer underflow in buffer size calculation causes srem and drem variables to overflow to SIZE_MAX, bypassing checks and allowing filenames to overwrite stack buffers via strcpy(). This can lead to remote code execution or denial-of-service.

Detection Guidance

To detect this vulnerability, check the installed version of Netatalk on your system. Run 'netatalk --version' or check package managers like 'dpkg -l netatalk' (Debian/Ubuntu) or 'rpm -qa | grep netatalk' (RHEL/CentOS). If the version is between 3.1.19 and 4.4.2, the system is vulnerable. Additionally, monitor afpd daemon crashes or unusual behavior during file operations across device boundaries.

Impact Analysis

If exploited, this vulnerability could allow an authenticated attacker to execute arbitrary code on the system running the vulnerable Netatalk service. Alternatively, it may cause the afpd daemon to crash, resulting in a denial-of-service condition. The impact depends on the privileges of the afpd process and the attacker's access level.

Mitigation Strategies

Immediately upgrade Netatalk to version 4.4.3 or later. If upgrading is not possible, configure AFP shared volumes to avoid cross-device directory structures by ensuring no subdirectory is a mount point for a different file system. This workaround prevents the vulnerable copydir() function from being triggered.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-45699. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart