EUVD-2026-31222
GHSA-766c-rr8x-xjvp
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
Primary rating from Vendor (securin) · only source for this CVE.
CVSS VectorVendor: securin
Lifecycle Timeline
1DescriptionCVE.org
In Netatalk 2.0.0 through 4.4.2, hextoint macro uppercase bug. Fixed in 4.5.0.
AnalysisAI
Incorrect hexadecimal-to-integer conversion in Netatalk 2.0.0 through 4.4.2 stems from a macro that fails to handle uppercase hex digits (A-F) correctly, producing wrong integer values during AFP protocol processing. An authenticated remote attacker with low privileges can exploit the flaw under high-complexity conditions to cause minor integrity corruption - for example, corrupted filename or attribute encoding. No public exploit code exists and the vulnerability is not listed in CISA KEV, making real-world exploitation unlikely in most environments. Fixed in Netatalk 4.5.0.
Technical ContextAI
Netatalk is an open-source Apple Filing Protocol (AFP) server implementation for Unix and Linux systems (CPE: cpe:2.3:a:netatalk:netatalk:*:*:*:*:*:*:*:*), enabling macOS and legacy Mac OS clients to mount remote file shares. CWE-682 (Incorrect Calculation) identifies the root cause: the 'hextoint' macro used internally for hex-to-integer conversion does not correctly handle uppercase hexadecimal digits (A-F), likely only processing lowercase equivalents (a-f). This produces arithmetically wrong integer results wherever the macro is invoked with uppercase hex input - a class of bug common in hand-rolled parsing utilities that bypass standard library functions like strtol(). The scope of impact depends on how broadly the macro is used across the AFP request-handling code paths.
RemediationAI
Vendor-released patch: Netatalk 4.5.0, which fixes the hextoint macro to correctly process uppercase hex digits. Administrators running any Netatalk release from 2.0.0 to 4.4.2 should upgrade to 4.5.0 as the primary remediation; see the vendor advisory at https://netatalk.io/security/CVE-2026-7836 for upgrade instructions. If an immediate upgrade is not feasible, a practical compensating control is to restrict AFP service access to trusted authenticated users only - since PR:L is required, reducing the pool of users with AFP login credentials limits exposure. Disabling AFP entirely in favor of SMB (Samba) where feasible eliminates the attack surface completely, though this may disrupt legacy macOS clients that rely on AFP. No known workaround addresses the macro-level bug without patching.
Netatalk before 3.1.12 is vulnerable to an out of bounds write in dsi_opensess.c. Rated critical severity (CVSS 9.8), th
Netatalk through 3.1.13 has an afp_getappl heap-based buffer overflow resulting in code execution via a crafted .appl fi
Heap buffer overflow in the Netatalk cnid_metad daemon's comm_rcv() function allows remote attackers with low-level priv
A Type Confusion vulnerability was found in the Spotlight RPC functions in afpd in Netatalk 3.1.x before 3.1.17. Rated c
The combination of primitives offered by SMB and AFP in their default configuration allows the arbitrary writing of file
Stack-based buffer overflow in Netatalk versions 2.0.4 through 4.4.2 allows authenticated remote attackers to corrupt me
SQL injection in Netatalk 3.1.0 through 4.4.2 allows authenticated remote attackers to compromise the MySQL-backed CNID
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Synology Dis
Arbitrary file read in Netatalk 3.0.2 through 4.4.2 allows authenticated remote attackers to create attacker-controlled
Path traversal via extended attribute (ea) handling in Netatalk 2.1.0 through 4.4.2 allows authenticated remote attacker
Shell injection in Netatalk 3.1.4 through 4.4.2 allows authenticated remote attackers to execute arbitrary OS commands t
Out-of-bounds write in Netatalk versions 2.0.4 through 4.4.2 stems from a missing o_len bounds check in the pull_charset
Same weakness CWE-682 – Incorrect Calculation
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today