EUVD-2026-58790Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable AFP service, authenticated low-privilege required (PR:L), non-trivial trigger condition (AC:H), and full CIA impact from memory corruption confirmed by vendor severity.
Primary rating from Vendor (vendor:alpine).
CVSS VectorVendor: vendor:alpine
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
6DescriptionCVE.org
Alpine Linux: netatalk fixed in 4.4.3-r0
AnalysisAI
Integer underflow (CWE-191) in Netatalk, the open-source Apple Filing Protocol (AFP) server, allows a network-authenticated attacker to trigger memory corruption that may result in information disclosure, arbitrary code execution, or denial of service. The vulnerability affects versions prior to 4.4.3 and is patched in Netatalk 4.4.3 (Alpine Linux package 4.4.3-r0). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated session to the Netatalk AFP service - the CVSS PR:L metric confirms low-privilege credentials (e.g., a standard AFP file-sharing account) are sufficient. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 7.5 with vector AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H reflects a high-impact but conditionally exploitable flaw. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker authenticated to an AFP service running a vulnerable Netatalk version sends a crafted protocol message containing a malformed logtype identifier or end-of-list marker that triggers an integer underflow in libatalk's logtype handling code. The underflow corrupts a length or index value used in subsequent memory operations, leading to an out-of-bounds read that leaks sensitive memory content or an out-of-bounds write that allows control of program execution. … |
| Remediation | Upgrade to Netatalk 4.4.3 - the vendor-released patch that addresses CVE-2026-45699 along with 19 other CVEs. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Netatalk deployments running versions prior to 4.4.3, particularly systems managing shared folders or network storage for macOS clients. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-191 – Integer Underflow
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today