In versions 3.1.19 through 4.4.2, a stack-based buffer overflow exists in the deletedir() function of Netatalk's afpd daemon due to an integer… (CVE-2026-45698)

Netatalk is a file server suite for Unix-like systems. In versions 3.1.19 through 4.4.2, the deletedir() function in the afpd daemon has a stack-based buffer overflow caused by an integer underflow in the calculation of the remaining buffer size for path construction. The remain variable, a size_t, underflows and becomes SIZE_MAX, causing boundary checks to incorrectly pass. This allows an unbounded strcpy() to copy attacker-controlled filenames into a nearly full stack buffer. The issue is fixed in version 4.4.3.

Successful exploitation can lead to a stack-based buffer overflow, potentially allowing an attacker to execute arbitrary code with the privileges of the afpd daemon. The CVSS 3.1 score is 7.5 (High), indicating high impact on confidentiality, integrity, and availability. However, the attack complexity is high and requires low privileges with no user interaction.

Upgrade Netatalk to version 4.4.3 or later, where this vulnerability is patched. No other mitigation is indicated by the vendor advisory.