Netatalk EUVD-2026-31239

Attacker must reach the afpd service over the network (default TCP port 548) and hold at least low-privileged AFP credentials (PR:L) - which on many deployments includes guest access if the volume is configured with 'guest ok' or anonymous login is enabled in afp.conf. Exploitation specifically targets the pull_charset_flags() codepath, so the attacker needs to trigger an AFP operation that performs charset conversion of attacker-controlled input (filenames, volume names, or other UTF-16-to-host-charset conversions). Exploitation is limited by the CVSS AC:H rating, indicating non-trivial conditions such as precise heap layout control or specific charset/locale configuration on the server, and by the requirement that the AFP service be exposed and enabled - installations that have migrated to SMB-only sharing are not exposed.

The CVSS 3.1 base score of 7.5 (High) breaks down as AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - network-reachable but requiring high attack complexity and an existing low-privileged session, with full CIA impact if successful. The AC:H component signals non-trivial exploitation (likely needing precise control over charset conversion inputs or heap layout), and PR:L means the attacker must first authenticate to the AFP service, which materially lowers real-world risk versus a fully unauthenticated RCE. There is no CISA KEV listing, no EPSS score provided, and no public exploit identified at time of analysis; combined with the niche protocol surface (AFP is increasingly deprecated by Apple in favor of SMB), this is best treated as a meaningful patch-soon issue for organizations still running Netatalk-backed shares - particularly NAS vendors - rather than a fire-drill emergency. Confirming whether the 'low privileges' threshold maps to a guest/IPC-style AFP session versus a fully authenticated user would sharpen the prioritization and should be checked against the vendor advisory.

An attacker with valid (or guest, if enabled) AFP credentials connects to TCP 548 on a Netatalk server and issues AFP requests carrying crafted filename, volume name, or metadata strings that drive pull_charset_flags() to convert input exceeding the destination buffer's tracked size. The resulting out-of-bounds write corrupts adjacent heap structures and, with sufficient heap-grooming precision (consistent with the CVSS AC:H rating), can be steered toward arbitrary code execution in the context of the afpd process - typically root on Linux servers and NAS firmware. No public exploit has been identified at time of analysis.