Netatalk CVE-2026-44056

Netatalk is an open-source implementation of the Apple Filing Protocol (AFP), used to provide macOS-compatible file sharing from Linux and Unix servers. The vulnerable component, desktop.c, handles AFP desktop database operations - a legacy feature that allows AFP clients to store metadata such as file icons and comments server-side. CWE-121 (Stack-based Buffer Overflow) identifies the root cause: data written to a stack-allocated buffer exceeds its bounds, potentially corrupting adjacent stack memory including return addresses or local variables, enabling denial of service or code execution. The CPE string cpe:2.3:a:netatalk:netatalk:*:*:*:*:*:*:*:* covers all platform variants of Netatalk across the affected version range. The CVSS vector (AV:N/AC:H/PR:L) is consistent with the AFP service being exposed over the network but requiring an established, authenticated AFP session to reach the desktop.c code path.