Netatalk CVE-2026-44050

Attacker must already possess low-level privileges on the target (CVSS PR:L), meaning a valid AFP/Netatalk account or equivalent authenticated session is required to reach the cnid_metad daemon's comm_rcv() code path. The Netatalk service must be running with the cnid_metad component enabled (the default when AFP file sharing is configured) on a version between 2.0.0 and 4.4.2 inclusive. Exploitation requires no user interaction (UI:N) and no special non-default configuration beyond having AFP enabled, but the requirement for an authenticated foothold meaningfully limits the population of attackers who can reach the bug, and the network exposure of the comm channel itself (versus a purely local IPC socket) should be verified against the vendor advisory.

The CVSS 9.9 score reflects a serious threat profile: network attack vector (AV:N), low attack complexity (AC:L), only low privileges required (PR:L), no user interaction (UI:N), and scope change (S:C) with high impact across all CIA dimensions. The scope change is notable - it implies the cnid_metad daemon, which often runs with elevated privileges, can be leveraged to affect resources beyond the attacker's original security context. However, real-world risk is tempered by several factors: the cnid_metad IPC channel is typically a local Unix socket reachable only after authenticating to AFP, which conflicts somewhat with the AV:N rating and warrants vendor clarification on whether the comm channel is genuinely network-exposed in any default configuration. EPSS score, KEV status, and SSVC decision data were not provided in the input, and no public exploit was identified at the time of analysis. The vulnerability should be treated as high priority for any internet- or LAN-exposed Netatalk deployments, particularly NAS appliances, but the realistic attacker prerequisites (PR:L) keep it below the tier of pre-auth wormable bugs.

An attacker with a valid low-privilege AFP user account connects to a vulnerable Netatalk server and triggers cnid_metad interactions by manipulating files or directories that cause crafted CNID messages to flow into comm_rcv(). The malformed message overflows a heap buffer in the daemon, which typically runs as root, allowing the attacker to corrupt adjacent heap structures and pivot to arbitrary code execution on the host - pivoting from a constrained file-share account to full server compromise.