A heap over-read in extended attribute (EA) header parsing in Netatalk 2.1.0 through 4.4.2 allows a remote authenticated attacker to obtain limited… (CVE-2026-44067)

A heap over-read occurs in the extended attribute header parsing component of Netatalk versions 2.1.0 through 4.4.2. This vulnerability enables a remote attacker with authentication privileges to trigger the flaw by supplying specially crafted extended attribute data. The result can be limited information disclosure or a minor disruption of service. The CVSS 3.1 base score is 4.2, reflecting network attack vector, high attack complexity, low privileges required, no user interaction, unchanged scope, limited confidentiality impact, no integrity impact, and low availability impact.

An authenticated remote attacker can exploit this vulnerability to gain limited information from the affected system or cause a minor service disruption. The impact does not include integrity compromise or significant availability loss, but confidentiality is partially affected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to trusted users and monitor for suspicious activity related to extended attribute handling in Netatalk.