Description

Netatalk is a Free and Open Source file server suite for Unix-like operating systems. In versions 3.1.19 through 4.4.2, a stack-based buffer overflow exists in the deletedir() function of Netatalk's afpd daemon due to an integer underflow in the calculation of the remaining buffer size used for path construction. deletedir() is a utility function called when a file operation crosses a device boundary inside an AFP shared volume, which the standard library's renameat() cannot handle. The function attempts to prevent buffer overflows by tracking available space in a size_t remain variable. However, the arithmetic used to compute remain results in an unsigned integer underflow, causing the variable to become SIZE_MAX. Because of this, the subsequent boundary check always evaluates as safe, allowing an unbounded strcpy() operation to copy attacker-controlled filenames into a nearly full stack buffer. Version 4.4.3 patches the issue.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-17T19:16:30.703Z",
  "pubdate": "2026-08-17T19:16:30.703Z",
  "executiveSummary": "A stack-based buffer overflow vulnerability exists in Netatalk versions 3.1.19 through 4.4.2.\nThe vulnerability resides within the deletedir() function of the afpd daemon and is caused by an integer underflow during buffer size calculations for path construction.\nAttackers can leverage this flaw by manipulating file operations that cross device boundaries inside an AFP shared volume, triggering the execution of deletedir().\nDue to the arithmetic error, the tracking variable remain underflows to SIZE_MAX, bypassing subsequent boundary checks.\nThis allows an unbounded strcpy() operation to copy attacker-controlled filenames into a stack buffer.\nSuccessful exploitation can result in memory corruption, potentially leading to arbitrary code execution within the context of the afpd daemon.\nThe issue is resolved in version 4.4.3.",
  "technicalDetails": "The vulnerability is a stack-based buffer overflow affecting the afpd daemon component of Netatalk, specifically within the deletedir() function.\nThe vulnerable function deletedir() is a utility routine invoked when file operations cross a device boundary inside an AFP shared volume, a condition that the standard library's renameat() function cannot natively handle.\nThe root cause of the vulnerability is an integer underflow occurring during the calculation of the remaining buffer size used for path construction.\nThe function attempts to track available space using a size_t variable named remain to prevent buffer overflows.\nHowever, the arithmetic operations used to compute remain result in an unsigned integer underflow, causing the value of remain to wrap around and become SIZE_MAX.\nBecause remain evaluates to SIZE_MAX, subsequent security boundary checks designed to validate buffer capacity always evaluate as safe.\nThis flawed validation permits an unbounded strcpy() operation to execute, copying attacker-controlled filenames into a nearly full stack buffer.\nExploitation occurs when an attacker crafts specific file operations within an AFP shared volume that trigger the device boundary cross handling handled by deletedir().\nBy supplying maliciously crafted filenames, the attacker forces the unbounded strcpy() to overflow the stack buffer.\nThe affected versions are Netatalk 3.1.19 through 4.4.2.\nThe vulnerability is patched in Netatalk version 4.4.3."
}