Netatalk CVE-2026-44057

Exploitation requires the attacker to hold valid credentials providing at least low-privilege access to the Netatalk service (confirmed by CVSS PR:L) - anonymous or unauthenticated exploitation is not possible. The Spotlight RPC component must be active and reachable on the target Netatalk instance; deployments where Spotlight integration is disabled or the AFP port is firewalled from the attacker are not exploitable. High attack complexity (AC:H per CVSS) is an explicit prerequisite, meaning the attacker cannot trivially send a generic malformed packet - precise crafting of the RPC request structure is required. The vulnerability is strictly limited to confidentiality impact: an attacker cannot modify data, crash the service, or escalate privileges. Environments where all Netatalk users are fully trusted and the service is not exposed beyond a controlled LAN segment face negligible realistic risk despite the network-reachable attack vector.

The CVSS 3.1 score of 3.1 accurately characterizes this as a low-severity issue. The vector (AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N) shows network reachability but imposes two meaningful barriers: high attack complexity (AC:H), indicating the exploit requires non-trivial precision in RPC payload crafting or timing, and authentication (PR:L), meaning anonymous exploitation is not possible. The impact is strictly bounded to low confidentiality disclosure with no integrity or availability consequence. No EPSS data was provided in available intelligence, so exploitation probability cannot be quantified independently. The vulnerability is not listed in the CISA KEV catalog, and no public exploit code has been identified, making opportunistic mass exploitation unlikely. For organizations running Netatalk in environments where AFP is internet-exposed or accessible to untrusted authenticated users, the risk is higher than the raw score implies - but for internal-only deployments with controlled user bases, this is a low-priority finding. The reporter (Securin) flagged this as an information disclosure class issue consistent with the CVSS impact ratings.

An authenticated user on a network with access to a Netatalk AFP server sends a specially crafted Spotlight RPC search request designed to probe unmarshaller behavior where the dead bounds check would normally gate processing. Because the bounds validation is unreachable dead code, the unmarshaller processes the malformed request without the intended constraint, potentially leaking limited information from RPC processing context or memory. No public exploit code exists at time of analysis, and the AC:H CVSS component indicates the attacker must invest significant effort in payload construction to reliably trigger the information disclosure.