Netatalk papd EUVD-2026-31213

Netatalk is an open-source Unix/Linux implementation of the Apple Filing Protocol (AFP) and AppleTalk protocol suite, enabling macOS and classic Mac OS clients to connect to Unix servers for file and print sharing. The affected component is papd - the Printer Access Protocol (PAP) daemon - which handles print job data sent over AppleTalk or AFP-compatible networks. The vulnerability is classified as CWE-193 (Off-by-One Error); however, the CVE description explicitly states 'off-by-two,' indicating a two-element boundary miscalculation in the lp_write() function. This type of error typically results from an incorrect loop bound or buffer size calculation, allowing writes slightly beyond an intended buffer boundary. The affected CPE is cpe:2.3:a:netatalk:netatalk:*:*:*:*:*:*:*:* covering versions 2.0.0 through 4.4.2. The CWE-193 classification and 'off-by-two' description present a minor discrepancy - the root cause class is a buffer boundary miscalculation, but whether it is precisely one or two positions off should be verified against the vendor's patch diff.