Netatalk CVE-2026-44048

Netatalk is an open-source implementation of the Apple Filing Protocol (AFP) suite, widely deployed on Linux/BSD NAS appliances and servers to provide native file sharing for macOS clients. The vulnerable convert_charset() routine performs character-set translation between AFP wire encodings and host encodings; a type confusion involving the UCS-2 (2-byte Unicode) code path miscalculates byte lengths versus character counts and writes attacker-influenced data past a fixed-size stack buffer. This is a classic CWE-121 stack-based buffer overflow, which on systems without robust stack canaries, ASLR, or non-executable stacks can yield reliable control-flow hijacking; even with modern mitigations it commonly produces a denial of service or memory-disclosure primitive. The CPE cpe:2.3:a:netatalk:netatalk:*:*:* confirms the upstream Netatalk package as the affected component rather than any single downstream distribution.