CVE-2026-45699

Executive Summary

CVE-2026-45699 is a stack-based buffer overflow in Netatalk, the open-source AFP file server suite for Unix-like operating systems. The flaw lives in the copydir() utility function of the afpd daemon and is caused by an integer underflow (CWE-191) in the arithmetic used to track remaining stack buffer space for path construction. Affected versions are Netatalk 3.1.19 through 4.4.2; the issue is fixed in version 4.4.3. Successful exploitation can lead to arbitrary code execution with the privileges of the network-exposed afpd process, with high impact on confidentiality, integrity, and availability of the file server (CVSS 7.5, High).

Technical Analysis

Netatalk implements the Apple Filing Protocol (AFP) for Unix-like systems, allowing macOS and legacy Apple clients to access shared volumes. The vulnerability described for CVE-2026-45699 is a classic stack-based buffer overflow reached through an integer underflow, classified as CWE-191.

The vulnerable code path is in the copydir() function of the afpd daemon. This function is a utility used when a file operation crosses a device boundary inside an AFP shared volume — i.e., when a source path and a destination path reside on different file systems mounted beneath a single shared volume root. The C standard library's renameat() call cannot handle cross-device renames (it fails with EXDEV), so Netatalk must fall back to a copy-and-delete routine implemented by copydir().

During path construction, copydir() attempts to track the amount of free space remaining in the fixed-size stack buffers used for source and destination paths. The description identifies two variables, srem and drem, intended to hold the remaining space for the source and destination path buffers respectively. Due to incorrect arithmetic, both srem and drem underflow and wrap to SIZE_MAX (2⁶⁴−1 on 64-bit platforms). After this underflow, the boundary checks that compare the remaining buffer space against strlen(de->d_name) — the length of the current directory entry name — always pass, because every plausible name length is smaller than SIZE_MAX. Consequently, strcpy() proceeds to append directory entry names into stack buffers that are nearly full, writing past the end of the buffer and corrupting adjacent stack memory.

The technical mechanism is therefore a two-stage failure: (1) an integer underflow in the remaining-space accounting (CWE-191), followed by (2) an unbounded strcpy() that overwrites stack memory (CWE-121-class behavior, reached via the underflow). The preconditions are notable: the vulnerable code path only executes when a shared volume contains a subdirectory that is itself a mount point for a different file system, and when a file operation crosses that boundary. Because this configuration is not universally present, the attack complexity in the CVSS vector is rated High (AC:H). The attacker also requires valid credentials or some level of share access, reflected in the Low privilege requirement (PR:L).

No public exploit code or proof-of-concept was identified in the supplied intelligence data. The precise stack layout, required filename lengths, and the effectiveness of stack canaries and compiler hardening in distribution builds are not specified and should be treated as insufficient technical detail in the public advisory at this time.

Exploitation Scenarios

The following attack chain is inferred from the vulnerability class and the NVD description. No public PoC is available; this is an assessment of the likely exploitation path, not a confirmed in-the-wild technique.

1. Reconnaissance / target identification. An attacker enumerates network-exposed AFP services, typically over TCP port 548, and fingerprint the server banner to confirm Netatalk and its version. They would then need to determine whether any AFP shared volume is structured such that a subdirectory is a mount point for a different file system — the specific configuration that reaches the vulnerable copydir() path.

2. Triggering the flaw. Using a valid AFP account (or a compromised low-privileged account), the attacker performs file operations — such as a move/rename — that cross a device boundary inside a shared volume. Because renameat() cannot handle cross-device operations, Netatalk invokes copydir(). The attacker crafts directory entry names (de->d_name values) such that the source and destination path stack buffers are nearly full, so that when the underflowed srem/drem values allow the boundary checks to pass, strcpy() appends attacker-influenced filename bytes past the end of the stack buffer.

3. Payload / execution method. At the vulnerability-class level, this is a stack buffer overflow. The attacker-controlled data written by strcpy() can be arranged to overwrite adjacent stack frame data — typically a saved return address or function pointers, assuming stack canaries are absent or bypassed. This permits redirecting execution into attacker-controlled memory, e.g., shellcode injected via the filename/path data or into a ROP chain, yielding code execution in the context of the afpd process.

4. Post-exploitation impact. The afpd daemon is the AFP server process that services all file requests for the host; successful code execution gives the attacker the same access rights as the daemon. This includes reading and modifying all files served via AFP shares, creating or deleting data (impacting integrity and availability), and potentially leveraging the compromised file server as a foothold for lateral movement within the enterprise network. A less severe but trivially achievable outcome is denial of service: overflowing the stack buffer can crash afpd, interrupting file service for all legitimate AFP clients.

It is important to emphasize that the high attack-complexity rating means exploitation is not turnkey: it depends on a specific volume layout (a mount point inside a share) and on the capability to craft names that reliably corrupt the stack without tripping mitigations.

Impact Assessment

The NVD-assigned CVSS 3.1 score is 7.5 (High) with vector CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H.

• Attack Vector (AV:N) — the afpd daemon is network-accessible over the AFP protocol, so the flaw can be triggered remotely.
• Attack Complexity (AC:H) — the vulnerable copydir() path only executes when a shared volume contains a cross-device mount point and when specific path/name conditions are met; this lowers the realistic exposure significantly.
• Privileges Required (PR:L) — an authenticated AFP user account is required. The attacker need not be privileged on the operating system, but must be able to create files/directories and trigger cross-boundary file operations in a share.
• User Interaction (UI:N) — no victim interaction is required.
• Scope (S:U) — the compromised component is the file server daemon; the impact is contained to the Netatalk host.
• Confidentiality/Integrity/Availability (C:H/I:H/A:H) — successful exploitation can yield full control of the file server process: unauthorized read of all shared data, modification/deletion of files, and service crashes.

Affected systems are Netatalk installations running versions 3.1.19 through 4.4.2, specifically those with AFP shares that contain mounted sub-filesystems (for example, a separate /home or storage mount exposed inside an AFP share). Enterprises that expose AFP shares to untrusted networks, or that allow many low-privileged users onto a shared file server, face the greatest risk. The business impact includes data exfiltration, ransomware-style file corruption, denial of service for all AFP consumers, and lateral movement from a compromised file server into the broader network.

EPSS has not yet been scored by FIRST.org, and CISA has not listed this CVE in the Known Exploited Vulnerabilities catalog, indicating no confirmed in-the-wild exploitation at the time of this report.

Detection Guidance

Detection of CVE-2026-45699 is complicated by the fact that the vulnerable code path is only reached under specific filesystem layout conditions. The most practical detection strategy is to (a) alert on abnormal afpd daemon crashes (a symptom of a triggered stack overflow), and (b) monitor for file operations that cross device boundaries inside AFP shares, which are the precondition for reaching copydir(). The following rules target those observable behaviors.

Sigma Rule

title: Netatalk afpd Daemon Crash or Abort - Possible CVE-2026-45699 Exploitation
id: 7f3c9d2e-5a1b-4c8f-9d3e-2b1a6f4c8d51
status: experimental
description: Detects crash events of the Netatalk afpd daemon (SIGSEGV, abort, stack smashing), which may indicate exploitation of CVE-2026-45699, a stack-based buffer overflow in copydir().
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-45699
author: Valtersit Threat Intelligence
date: 2026/01/15
tags:
    - attack.t1190
    - cve.2026.45699
logsource:
    product: linux
    service: journald
detection:
    selection_crash:
        journald.message|contains|all:
            - 'afpd'
            - 'Segmentation fault'
    selection_signal:
        journald.message|contains|all:
            - 'afpd'
            - 'signal 11'
    selection_smash:
        journald.message|contains|all:
            - 'afpd'
            - 'stack smashing detected'
    selection_abort:
        journald.message|contains|all:
            - 'afpd'
            - 'core dumped'
    condition: selection_crash or selection_signal or selection_smash or selection_abort
level: high
falsepositives:
    - Legitimate afpd crashes caused by hardware faults, memory pressure, or unrelated kernel bugs
    - Malformed AFP requests triggering benign daemon aborts

YARA Rule

/*
   YARA rule for CVE-2026-45699 (Netatalk afpd copydir stack buffer overflow).
   Intended for triage of forensic artifacts: core dumps, memory captures,
   and packet captures. These are behavioral indicators, not proof of compromise.
*/
rule netatalk_afpd_cve_2026_45699_copydir
{
    meta:
        author      = "Valtersit Threat Intelligence"
        description = "Detects artifacts consistent with exploitation of CVE-2026-45699: repeated AFP path separators (UTF-16BE) and deep path traversal sequences associated with Netatalk afpd processing."
        cve         = "CVE-2026-45699"
        date        = "2026-01-15"
        reference   = "https://nvd.nist.gov/vuln/detail/CVE-2026-45699"

    strings:
        $a = "Netatalk" ascii
        $b = "afpd" ascii wide
        $c = { 00 2F 00 2F 00 2F }                 /* UTF-16BE "///" AFP path separators */
        $d = /(?:\.\.\/){4,}/                      /* repeated traversal sequences */

    condition:
        (($a or $b) and #c >= 3) or ($b and $d)
}

Suricata IDS Rule

# CVE-2026-45699 — Netatalk afpd copydir stack-based buffer overflow
# Detects AFP (TCP/548) DSI requests containing repeated UTF-16BE path
# separators ('/' = 0x00 0x2F), consistent with attacker-controlled path
# construction targeting the copydir() overflow.
# AFP DSI request packets begin with 0x00.
alert tcp any any -> any 548 (msg:"ET EXPLOIT Netatalk afpd copydir Stack Buffer Overflow Attempt (CVE-2026-45699)"; flow:established,to_server; content:"|00|"; depth:1; pcre:"/(?:\x00\x2f){3,}/R"; reference:cve,2026-45699; classtype:attempted-admin; sid:202645699; rev:1;)

# Alternative rule: flag unusually large AFP DSI payloads (possible overflow payload)
alert tcp any any -> any 548 (msg:"ET EXPLOIT Netatalk afpd Oversized AFP Path Payload (CVE-2026-45699)"; flow:established,to_server; content:"|00|"; depth:1; dsize:>20000; reference:cve,2026-45699; classtype:attempted-admin; sid:202645700; rev:1;)

Elastic Detection

// EQL: Detect unexpected termination of the Netatalk afpd daemon.
// A stack overflow in copydir() will typically crash the process with SIGSEGV.
// exit_code 139 corresponds to shell-reported 128+11 (SIGSEGV); -11 is the raw signal form.
process where event.category == "process" and event.type == "end"
    and process.name == "afpd"
    and (process.exit_code == 139 or process.exit_code == -11)

// EQL: Auditd-based detection for abnormal task abends involving afpd.
any where event.module == "auditd" and event.action == "ANOM_ABEND"
    and process.name == "afpd"

Splunk SPL Query

(
    (index=linux sourcetype=linux_audit type="ANOM_ABEND" proctitle="*afpd*")
    OR
    (
        (index=linux sourcetype=journald OR sourcetype=syslog)
        ("Segmentation fault" OR "signal 11" OR "stack smashing detected" OR "core dumped")
        "afpd"
    )
)
| stats count earliest(_time) latest(_time) by host, src_ip, proctitle, message
| sort - latest(_time)
| rename count as "Crash Events"

Wazuh OSSEC Rule

<group name="netatalk,">
    <!-- High severity: afpd crash indicates possible CVE-2026-45699 stack overflow exploitation -->
    <rule id="100456" level="12">
        <decoded_as>syslog</decoded_as>
        <program_name>afpd</program_name>
        <match>Segmentation fault|signal 11|stack smashing detected|core dumped</match>
        <description>Netatalk afpd daemon crashed - possible CVE-2026-45699 buffer overflow exploitation.</description>
        <mitre>
            <id>T1190</id>
        </mitre>
        <group>netatalk,exploit,afpd,</group>
    </rule>

    <!-- Medium severity: cross-device file operation in an AFP share - precondition for reaching copydir() -->
    <rule id="100457" level="5">
        <decoded_as>syslog</decoded_as>
        <program_name>afpd</program_name>
        <match>cross-device|Invalid cross-device link|EXDEV</match>
        <description>Netatalk afpd encountered a cross-device file operation inside an AFP share - prerequisite for CVE-2026-45699 exploitation.</description>
        <group>netatalk,afpd,</group>
    </rule>
</group>

Mitigation & Patch Guidance

Patch confidence is rated 3/4 (LIKELY), with two independent sources (OSV and Debian) confirming the fix. The authoritative remediation is to upgrade to Netatalk 4.4.3 or later.

1. Immediate mitigations

   • Apply the vendor workaround: configure each AFP shared volume so that it is structured as a single file system. In other words, no subdirectory of a shared volume should be a mount point for a different file system. This eliminates the precondition for reaching the vulnerable copydir() code path entirely.
   • If the workaround cannot be applied immediately, restrict network access to the AFP service (TCP 548) using firewall rules or access control lists so that only trusted clients can reach the port.
   • If AFP service is not business-critical, disable it (afpd shutdown / service stop) until the patch can be deployed.

2. Patch / upgrade steps

   • Upgrade all affected Netatalk installations to version 4.4.3 or newer. Validate package checksums and signatures.
   • For package-managed systems, pull the updated package from the vendor’s or distribution’s security repository (Debian tracker and OSV both reference the fix).
   • Verify after upgrade that afpd restarts cleanly and that all shared volumes are served correctly, especially any configurations that previously relied on multi-filesystem volumes (and restructure them per the workaround).

3. Long-term hardening

   • Audit all AFP share definitions; remove embedded mount points from share trees or move them outside the exported namespace.
   • Apply the principle of least privilege for AFP accounts; restrict write access where users do not require it.
   • Verify that distribution builds of Netatalk are compiled with standard memory-protection mitigations (ASLR, stack canaries, RELRO). Where weaker builds are in use, prioritize replacement.
   • Maintain centralized logging and alerting on daemon crashes (see Detection Guidance) so that attempted exploitation of this and similar flaws is visible to the SOC.
   • Treat the file server as a high-value asset: segment it from the rest of the network, enforce strong authentication, and monitor for lateral movement from file-server systems.

Note: CISA KEV does not currently list CVE-2026-45699, and EPSS has not yet been scored; no in-the-wild exploitation campaigns have been identified in the supplied data.

References

• NVD — CVE-2026-45699: https://nvd.nist.gov/vuln/detail/CVE-2026-45699
• OSV vulnerability entry: https://osv.dev/vulnerability/CVE-2026-45699
• Debian Security Tracker: https://security-tracker.debian.org/tracker/CVE-2026-45699
• Netatalk project (official source and release announcements): https://netatalk.sourceforge.io/
• CISA Known Exploited Vulnerabilities Catalog (not currently listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat actor activity: At the time of writing, no known threat-actor campaigns or exploit-in-the-wild evidence for CVE-2026-45699 have been reported in the supplied intelligence data.