Netatalk papd CVE-2026-44065

Exploitation requires the attacker to be on the same adjacent network (LAN or VLAN) as the target - the AV:A vector explicitly excludes internet-based exploitation. The papd (Printer Access Protocol daemon) service must be running and reachable; papd is not enabled by default in all Netatalk deployments and is only relevant to environments sharing printers with legacy Mac OS or AppleTalk clients. High attack complexity (AC:H) limits exploitation further, indicating that a straightforward, reliable exploit is not trivially achievable and may require conditions outside the attacker's direct control. No privileges are required (PR:N) and no user interaction is needed (UI:N). Exploitation is limited to environments where: (1) papd is explicitly enabled, (2) the attacker has adjacent-network reachability to the papd service, and (3) the attacker can navigate the high-complexity exploitation requirements. Systems running Netatalk solely for AFP file sharing without papd active are not exposed.

Real-world risk is low across all available signals. The CVSS score is 3.7 (Low), with a vector of AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L, meaning exploitation requires adjacent network access (same LAN or VLAN - not internet-routable), high attack complexity, and yields only limited integrity and availability impact with zero confidentiality exposure. No EPSS data was provided; given the adjacent-only vector and high complexity, exploitation probability is expected to be low. No CISA KEV listing and no public exploit code have been identified at time of analysis. The 'Information Disclosure' tag from the intelligence source conflicts with the CVSS C:N (no confidentiality impact) - this discrepancy should be noted; it may reflect tagging error or a secondary information-leak path not fully captured in the CVSS vector. The CWE-193 vs. 'off-by-two' mismatch is also a minor data-quality concern. Overall, this is a genuine but low-priority vulnerability: the attack surface is restricted to adjacent networks running papd (a relatively niche service), complexity is high, and impact is limited. It does not exhibit characteristics of a priority vulnerability absent any KEV or POC signal.

An attacker with access to the same local network segment as a host running Netatalk papd crafts a malformed print job request that triggers the off-by-two boundary error in lp_write(). Due to the high attack complexity (AC:H), successfully triggering the bug likely requires precise timing, specific print job formatting, or iterative trial and error to produce the minor integrity or availability impact described. No public exploit code has been identified at time of analysis.