CVE-2026-45698 Overview
CVE-2026-45698 is a stack-based buffer overflow in the deletedir() function of Netatalk's afpd daemon. Netatalk is a Free and Open Source file server suite that implements the Apple Filing Protocol (AFP) on Unix-like operating systems. The flaw affects versions 3.1.19 through 4.4.2 and stems from an integer underflow ([CWE-191]) in remaining buffer size arithmetic. An authenticated attacker with low privileges on an AFP share can trigger the overflow by supplying crafted filenames during cross-device file operations. Version 4.4.3 patches the vulnerability.
Critical Impact
Authenticated attackers can corrupt stack memory in afpd, potentially leading to code execution in the file server process with full confidentiality, integrity, and availability impact.
Affected Products
- Netatalk 3.1.19 through 4.4.2 (afpd daemon)
- Unix-like systems exposing AFP shares via vulnerable Netatalk builds
- Downstream distributions packaging affected Netatalk versions
Discovery Timeline
- 2026-08-17 - CVE-2026-45698 published to the National Vulnerability Database
- 2026-08-17 - Last updated in NVD database
Technical Details for CVE-2026-45698
Vulnerability Analysis
The deletedir() function is a utility routine invoked when a file operation crosses a device boundary inside an AFP shared volume. The standard library's renameat() cannot handle cross-device moves, so Netatalk implements its own path-construction logic. To guard against buffer overflows, the function tracks available space using a size_t remain variable and performs a boundary check before copying attacker-controlled filenames into a fixed-size stack buffer.
The arithmetic used to compute remain produces an unsigned integer underflow. When the running length exceeds the buffer size, subtracting it from the total buffer capacity wraps around and sets remain to SIZE_MAX. The subsequent bounds comparison then always succeeds, and the following strcpy() proceeds unbounded into a nearly full stack buffer.
Root Cause
The root cause is unsigned integer underflow in size accounting, classified as [CWE-191]. The code assumes remain monotonically decreases toward zero, but no invariant enforces that the running total stays within buffer bounds before the subtraction. Once remain wraps to the maximum value of size_t, every subsequent length check becomes meaningless.
Attack Vector
Exploitation requires an authenticated AFP session with permissions to perform file operations that cross a device boundary within a shared volume. The attacker plants a directory structure containing long filenames and triggers a rename operation that forces afpd into the deletedir() fallback path. The unbounded strcpy() then copies the attacker-controlled filename past the end of the stack buffer, overwriting saved registers, return addresses, or adjacent stack variables. Successful exploitation can lead to arbitrary code execution in the afpd process. The high attack complexity reflects the specific conditions required to reach the vulnerable code path and control useful memory. See the GitHub Security Advisory GHSA-5443 for additional technical detail.
Detection Methods for CVE-2026-45698
Indicators of Compromise
- Unexpected afpd process crashes, segmentation faults, or restarts on hosts running vulnerable Netatalk versions.
- AFP session activity containing directory entries or filenames with anomalously long path components immediately preceding a crash.
- Cross-device rename or move operations issued against AFP shares from low-privilege authenticated users.
Detection Strategies
- Inventory installed Netatalk builds and flag any version between 3.1.19 and 4.4.2 inclusive.
- Monitor system logs and coredumpctl output for afpd termination signals such as SIGSEGV or SIGABRT.
- Correlate authentication events on AFP shares with subsequent daemon restarts to identify potential exploitation attempts.
Monitoring Recommendations
- Forward afpd logs and kernel crash records to a central logging platform for correlation with AFP authentication events.
- Alert on repeated afpd restarts from the same source client address within a short time window.
- Track file operations that trigger the cross-device rename fallback path, since normal workloads rarely cross device boundaries inside a single share.
How to Mitigate CVE-2026-45698
Immediate Actions Required
- Upgrade all Netatalk installations to version 4.4.3 or later using the fixed release from the Netatalk 4.4.3 release notes.
- Restrict AFP share access to trusted, authenticated users and remove access for accounts that do not require file server functionality.
- Audit AFP shares for volumes that span multiple devices or mount points, since these configurations are required to reach deletedir().
Patch Information
Netatalk 4.4.3 corrects the size accounting in deletedir() so that the boundary check cannot be bypassed via unsigned integer underflow. Administrators should upgrade from source or apply distribution packages that incorporate the 4.4.3 fix. Refer to the GitHub Security Advisory GHSA-5443 for the authoritative fix reference.
Workarounds
- Disable the afpd service on hosts where AFP is not required until the patch can be applied.
- Firewall AFP (TCP/548) so that only trusted management networks can reach the service.
- Reconfigure shared volumes to reside on a single device so that cross-device operations cannot invoke the vulnerable code path.
# Verify installed Netatalk version and confirm it is 4.4.3 or later
afpd -V
# Restrict AFP to a trusted management subnet using nftables
nft add rule inet filter input tcp dport 548 ip saddr != 10.0.0.0/24 drop
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
