CVE-2026-45699
Description
A flaw was found in Netatalk. An integer underflow vulnerability exists in the copydir() function of the afpd daemon. This flaw occurs when a file operation crosses a device boundary within an Apple Filing Protocol (AFP) shared volume. Incorrect calculation of buffer size can lead to a stack-based buffer overflow, potentially allowing an attacker to achieve arbitrary code execution or cause a denial of service.
Statement
Netatalk is not shipped in any Red Hat product. The community builds in Fedora (4.4.3) and EPEL (3.1.18) are both outside the vulnerable version range (3.1.19–4.4.2) and are not affected by this vulnerability.
Mitigation
No mitigation is needed as no Red Hat products or community distributions ship a vulnerable version of Netatalk.
Understanding the Weakness (CWE)
Integrity,Confidentiality,Availability
Technical Impact: Modify Memory; Execute Unauthorized Code or Commands
Buffer overflows often can be used to execute arbitrary code, which is usually outside the scope of the product's implicit security policy. This can often be used to subvert any other security service.
Availability
Technical Impact: Modify Memory; DoS: Crash, Exit, or Restart; DoS: Resource Consumption (CPU)
Buffer overflows generally lead to crashes. Other attacks leading to lack of availability are possible, including putting the product into an infinite loop.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
