---
id: CVE-2026-45699
title: >-
  Netatalk is a Free and Open Source file server suite for Unix-like operating
  systems
summary: >-
  Netatalk is a Free and Open Source file server suite for Unix-like operating
  systems. In versions 3.1.19 through 4.4.2, a  stack-based buffer overflow
  exists in the copydir() function of Netatalk's afpd daemon due to an integer
  underflow…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-191
published: '2026-08-14'
updated: '2026-09-18'
sourceUpdated: '2026-09-18T20:09:01.757'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-45699'
references:
  - url: 'https://github.com/Netatalk/netatalk/releases/tag/netatalk-4-4-3'
    label: security-advisories@github.com
  - url: >-
      https://github.com/Netatalk/netatalk/security/advisories/GHSA-fphv-pf29-p77m
    label: security-advisories@github.com
tags:
  - nvd
epss: 0.0045
epssPercentile: 0.36508
ingestedAt: '2026-09-18T20:51:25.617Z'
---

## Overview

Netatalk is a Free and Open Source file server suite for Unix-like operating systems. In versions 3.1.19 through 4.4.2, a  stack-based buffer overflow exists in the copydir() function of Netatalk's afpd daemon due to an integer underflow in the calculation of the remaining buffer size used for path construction. copydir() is a utility function called when a file operation crosses a device boundary inside an AFP shared volume, which the standard library's renameat() cannot handle. The function attempts to track available buffer space using srem and drem for source and destination paths. Incorrect arithmetic causes both srem and drem to underflow to SIZE_MAX. Consequently, boundary checks against strlen(de->d_name) always pass, allowing strcpy() to append filenames into nearly full stack buffers. Version 4.4.3 patches the issue. As a workaround, configure each AFP shared volume to be structured as a single file system, in other words no subdirectory of a shared volume should be a mount point for a different file system.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.