CVE-2026-44050
A critical heap-based buffer overflow exists in the CNID daemon of Netatalk versions 2.0.0 through 4.4.2. The flaw allows a remote, authenticated attacker to run arbitrary code with elevated privileges or crash the service. It is a severe vulnerability that can compromise the entire system.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Netatalk 2.0.0 to 4.4.2, used on Unix-like servers that provide AppleTalk file sharing services. Administrators and users of these servers are at risk.
Real-world impact
An attacker who can authenticate to the Netatalk server can exploit the overflow to execute arbitrary code with root or system privileges, potentially taking full control of the host. They could also cause a denial of service by crashing the CNID daemon, disrupting file sharing services.
Why this severity
The CVSS score of 9.9 reflects the combination of network accessibility, low attack complexity, low privileges required, and the impact of confidentiality, integrity, and availability—all of which are high. The vector shows that the vulnerability is exploitable over the network by an attacker who only needs to be authenticated, and it can lead to full system compromise or service disruption.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources
Timeline
- May 21, 2026 · May 21, 2026PublishedDisclosed and added to the National Vulnerability Database.
- Jul 23, 2026 · 12d agoAdvisory updatedThe NVD record was last revised.