Netatalk CVE-2026-44048

Exploitation requires (1) network reachability to the Netatalk afpd service, typically TCP 548 for AFP-over-TCP, (2) at least low-privilege AFP authentication per CVSS PR:L - this can be a guest account where guest access is enabled, or any valid user, (3) a Netatalk daemon at version 2.0.4 through 4.4.2, and (4) the ability to send AFP requests that traverse the convert_charset() UCS-2 conversion path, which is reached during routine filename and volume-name handling. Limiting factors that reduce real-world risk: the authentication requirement (PR:L) prevents fully unauthenticated internet-wide exploitation, deployments that bind afpd only to internal interfaces are not reachable from the public internet, and successful code execution requires bypassing modern stack-overflow mitigations (stack canaries, ASLR, NX) typically enabled on mainstream Linux/BSD builds.

The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H scores 8.8 and indicates network reach, low complexity, no user interaction, and authenticated access (PR:L) - meaning an attacker must already hold valid AFP credentials, even guest-level, to reach the vulnerable charset path. Exploitation status is no public exploit identified at time of analysis, the CVE is not present in CISA KEV, and EPSS data was not supplied in the intelligence package and is therefore unknown. The combination of pre-auth gating with a memory-safety bug in a long-lived network daemon historically attracts exploit development; environments that enable AFP guest access or expose Netatalk to untrusted networks should treat this as a real priority, while internal-only deployments with strong authentication face meaningfully lower realistic risk. No conflicting signals were observed in the provided data.

An attacker with valid (or guest) AFP credentials connects to an exposed Netatalk afpd service and issues a request whose filename, volume name, or other string argument forces the server through the UCS-2 conversion path in convert_charset(), supplying a payload whose byte length defeats the misapplied character-count assumption. The resulting stack overflow can crash the daemon or, with bypasses for stack canaries and ASLR, allow execution of code in the context of the afpd process (often root on NAS appliances). No public exploit identified at time of analysis, but the low attack complexity and well-understood bug class make weaponization plausible.