Netatalk CVE-2026-45699

Exploitation requires an authenticated session to the Netatalk AFP service - the CVSS PR:L metric confirms low-privilege credentials (e.g., a standard AFP file-sharing account) are sufficient. The AC:H metric indicates a specific protocol condition must be met: based on the linked release notes, the vulnerable code path in libatalk is triggered by passing an end_of_list_marker or malformed logtype identifier during AFP session activity. Exploitation is limited to: (1) network reachability to TCP port 548 (AFP), (2) valid AFP authentication credentials, and (3) ability to craft or trigger the specific malformed logtype input. Default AFP configurations that require user authentication are a meaningful barrier. Unauthenticated exploitation is not supported by the available CVSS data.

The CVSS 3.1 base score of 7.5 with vector AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H reflects a high-impact but conditionally exploitable flaw. AC:H limits opportunistic mass exploitation - specific protocol state or message construction is required to trigger the underflow. PR:L confirms authenticated access is a prerequisite, further constraining the attacker population to users who can log into the AFP service. The C:H/I:H/A:H impact triad suggests the underflow can escalate to memory corruption with full-system consequences if successfully triggered. No EPSS data was provided, and the vulnerability is not listed in CISA KEV, indicating no confirmed active exploitation. No POC is referenced in the available data. The real-world risk is moderate: Netatalk deployments are relatively niche (legacy Apple/macOS file sharing environments), and the AC:H requirement significantly reduces the automated exploitation surface. This should be prioritized for patching in environments actively serving AFP clients, but does not warrant emergency response compared to unauthenticated, low-complexity network vulnerabilities.

An attacker authenticated to an AFP service running a vulnerable Netatalk version sends a crafted protocol message containing a malformed logtype identifier or end-of-list marker that triggers an integer underflow in libatalk's logtype handling code. The underflow corrupts a length or index value used in subsequent memory operations, leading to an out-of-bounds read that leaks sensitive memory content or an out-of-bounds write that allows control of program execution. No public proof-of-concept code has been identified at time of analysis, and the AC:H rating suggests reliable exploitation requires non-trivial protocol knowledge or heap state manipulation.