Description

Netatalk is a Free and Open Source file server suite for Unix-like operating systems. In versions 3.1.19 through 4.4.2, a stack-based buffer overflow exists in the copydir() function of Netatalk's afpd daemon due to an integer underflow in the calculation of the remaining buffer size used for path construction. copydir() is a utility function called when a file operation crosses a device boundary inside an AFP shared volume, which the standard library's renameat() cannot handle. The function attempts to track available buffer space using srem and drem for source and destination paths. Incorrect arithmetic causes both srem and drem to underflow to SIZE_MAX. Consequently, boundary checks against strlen(de->d_name) always pass, allowing strcpy() to append filenames into nearly full stack buffers. Version 4.4.3 patches the issue. As a workaround, configure each AFP shared volume to be structured as a single file system, in other words no subdirectory of a shared volume should be a mount point for a different file system.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-14T19:17:18.267Z",
  "pubdate": "2026-08-14T19:17:18.267Z",
  "executiveSummary": "A stack-based buffer overflow vulnerability exists in Netatalk within the copydir() function of the afpd daemon affecting versions 3.1.19 through 4.4.2.\nThe vulnerability arises from an integer underflow during the calculation of remaining buffer space used for path construction when file operations cross device boundaries inside an AFP shared volume.\nSuccessful exploitation allows attackers to cause memory corruption via the unchecked appending of filenames into stack buffers using strcpy().\nThis impacts the availability and integrity of the afpd daemon, potentially enabling arbitrary code execution depending on the execution context and compiler mitigations.\nThe attack requires the ability to trigger file operations that cross device boundaries inside an AFP shared volume.\nRisk implications are significant for environments utilizing multi-mount shared volumes without adequate volume structure isolation.",
  "technicalDetails": "The root cause of the vulnerability resides in the copydir() utility function of the afpd daemon, which handles file operations crossing device boundaries inside an AFP shared volume that the standard library renameat() function cannot process.\nThe function tracks available destination and source buffer space using the srem and drem variables for path construction.\nAn integer underflow occurs in the calculation of the remaining buffer size, causing both srem and drem to wrap around and underflow to SIZE_MAX.\nConsequently, subsequent boundary checks against strlen(de->d_name) always evaluate to true, bypassing safety checks.\nThis flaw allows strcpy() to uncontrollably append directory entry filenames into nearly full stack-allocated buffers.\nThe vulnerable component is the copydir() function within the afpd daemon of Netatalk versions 3.1.19 through 4.4.2.\nExploitation occurs step-by-step when an authenticated user or client initiates a file operation, such as a rename or move command, that forces the application to execute copydir() across a device boundary.\nThe oversized path construction triggered by the integer underflow overwrites stack memory structures during the execution of strcpy().\nPost-exploitation impact includes denial of service through daemon crashes or potential remote code execution on the host running the afpd daemon."
}