Netatalk CVE-2026-44074

Exploitation requires network reachability to the Netatalk AFP service, typically exposed on TCP port 548. No authentication is required (PR:N per CVSS) and no user interaction is needed (UI:N). No non-default configuration is indicated as a prerequisite - any Netatalk deployment running versions 2.1.0 through 4.4.2 with the AFP service network-accessible is within scope. The primary limiting factor is high attack complexity (AC:H): the attacker must reliably trigger multiple simultaneous error conditions within the service, which requires precise timing or condition manipulation that is difficult to achieve externally without detailed knowledge of internal state. Impact is strictly bounded to minor availability disruption (A:L); there is no path to data access or code execution based on the available CVSS and description data.

The CVSS 3.1 base score of 3.7 (Low) is supported by all available signals. The vector AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L indicates network reachability without authentication or user interaction, but the high attack complexity (AC:H) is a significant practical barrier - an attacker must reliably engineer concurrent error conditions, which is non-trivial to control externally. Impact is bounded to minor availability disruption (A:L) with zero confidentiality or integrity consequence. EPSS data was not provided in the source intelligence, so exploitation probability cannot be quantified probabilistically. No CISA KEV listing exists, and no public POC has been identified, indicating no confirmed or demonstrated exploitation. Notably, the intelligence tag 'Information Disclosure' conflicts with the CVSS C:N indicator - this discrepancy is unexplained by available data and should not be treated as confirmed; the CVSS vector is the more authoritative signal for impact classification. Overall, this is a genuine low-priority issue: real-world exploitation requires precise timing of simultaneous error states, and the worst-case outcome is transient AFP service disruption rather than data loss or remote code execution.

An unauthenticated remote attacker sends a sequence of crafted requests to the Netatalk AFP service that simultaneously triggers multiple internal error conditions, causing the bitwise OR combination of errno values to produce an invalid error code and redirect execution into an incorrect error-handling path. The result is a minor disruption to AFP service availability - such as connection resets or transient unresponsiveness - affecting Apple clients sharing files through the service. No public exploit code exists at time of analysis, and the AC:H requirement makes reliable exploitation difficult to achieve opportunistically.