CVE-2026-44065: Netatalk papd DoS Vulnerability

CVE-2026-44065 Overview

CVE-2026-44065 is an off-by-two error in the lp_write() function in papd, the AppleTalk Printer Access Protocol daemon shipped with Netatalk. The flaw affects Netatalk versions 2.0.0 through 4.4.2. An attacker on an adjacent network can send crafted print data to trigger the boundary miscalculation. Successful exploitation allows limited modification of data or minor service disruption in the papd process. The issue is tracked under CWE-193: Off-by-one Error and is documented in the Netatalk Security Advisory.

Critical Impact
Adjacent network attackers can corrupt limited memory or disrupt the papd print service through crafted print job data sent to vulnerable Netatalk deployments.

Affected Products

Netatalk 2.0.0 through 4.4.2
papd AppleTalk Printer Access Protocol daemon
Systems exposing Netatalk print services to adjacent networks

Discovery Timeline

2026-05-21 - CVE CVE-2026-44065 published to NVD
2026-05-21 - Last updated in NVD database

Technical Details for CVE-2026-44065

Vulnerability Analysis

The vulnerability resides in lp_write(), a function inside papd that handles writing print data received over the AppleTalk Printer Access Protocol. An off-by-two error causes the function to write or process two bytes beyond an intended boundary. This boundary miscalculation creates a small, controlled memory corruption window. The impact is constrained to limited integrity loss and limited availability loss, with no confidentiality impact according to the vendor advisory.

Exploitation requires the attacker to be on an adjacent network segment where Netatalk print services are reachable. High attack complexity reflects the precise timing or input shaping needed to reliably trigger the condition through crafted print data.

Root Cause

The root cause is an off-by-two arithmetic error [CWE-193] in buffer boundary calculations within lp_write(). The function miscomputes the size or offset used when handling incoming print payloads, allowing two bytes of overflow or out-of-bounds access. Off-by-one and off-by-two errors typically arise from incorrect use of inclusive versus exclusive bounds, or from incorrect pointer arithmetic when terminator bytes are appended.

Attack Vector

An attacker on the same local or adjacent network segment establishes a connection to the papd service and submits crafted print data. The malformed input drives lp_write() through the vulnerable path, where the off-by-two miscalculation produces limited memory corruption. The attacker cannot read sensitive memory but can alter small adjacent values or cause the daemon to misbehave. No authentication or user interaction is required.

See the Netatalk Security Advisory for protocol-level details.

Detection Methods for CVE-2026-44065

Indicators of Compromise

Unexpected crashes or restarts of the papd daemon in system logs
Malformed or oversized AppleTalk Printer Access Protocol print jobs originating from adjacent network hosts
Anomalous print spool entries or partial print payloads tied to papd sessions

Detection Strategies

Monitor papd process logs and core dumps for repeated abnormal terminations
Inspect AppleTalk print traffic for print jobs with abnormal length fields or trailing byte patterns
Baseline normal print job sizes per host and alert on statistical outliers reaching papd

Monitoring Recommendations

Forward Netatalk service logs to a centralized logging platform for correlation
Track restart counts and exit codes for papd over rolling windows to detect repeated triggering attempts
Alert on connections to papd from hosts that do not normally print to AppleTalk shares

How to Mitigate CVE-2026-44065

Immediate Actions Required

Upgrade Netatalk to a fixed release published after version 4.4.2 as listed in the Netatalk Security Advisory
Restrict access to the papd service to trusted print clients using host-based firewall rules
Disable papd entirely on Netatalk deployments that do not require AppleTalk printer sharing

Patch Information

Refer to the Netatalk Security Advisory for the patched version and upgrade instructions. Administrators running Netatalk 2.0.0 through 4.4.2 should plan an upgrade to the vendor-supplied fixed release. Distribution maintainers typically backport such fixes; verify package versions against the advisory before relying on distribution updates.

Workarounds

Disable the papd service in the Netatalk configuration when AppleTalk printing is not required
Segment Netatalk hosts onto isolated network zones so adjacent-network attackers cannot reach papd
Apply ACLs at switches or firewalls to permit AppleTalk print traffic only from known print clients

bash

# Configuration example: disable papd by removing or commenting its launch
# In the Netatalk init configuration (e.g., /etc/default/netatalk):
PAPD_RUN=no

# Or stop and disable the service via systemd:
sudo systemctl stop netatalk-papd
sudo systemctl disable netatalk-papd