CVE-2026-45698

Netatalk is a Free and Open Source file server suite for Unix-like operating systems. In versions 3.1.19 through 4.4.2, a stack-based buffer overflow exists in the deletedir() function of Netatalk's afpd daemon due to an integer underflow in the calculation of the remaining buffer size used for path construction. deletedir() is a utility function called when a file operation crosses a device boundary inside an AFP shared volume, which the standard library's renameat() cannot handle. The function attempts to prevent buffer overflows by tracking available space in a size_t remain variable. However, the arithmetic used to compute remain results in an unsigned integer underflow, causing the variable to become SIZE_MAX. Because of this, the subsequent boundary check always evaluates as safe, allowing an unbounded strcpy() operation to copy attacker-controlled filenames into a nearly full stack buffer. Version 4.4.3 patches the issue.

• CWE-191

• https://github.com/Netatalk/netatalk/releases/tag/netatalk-4-4-3
• https://github.com/Netatalk/netatalk/security/advisories/GHSA-5443-v9xg-mqgv

Published

Aug 17, 2026

Last Modified

Sep 9, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-45691Nextcloud is an open source content collaboration platform. …5.9
• CVE-2026-45692Caddy is an extensible server platform that uses TLS by defa…3.8
• CVE-2026-45694LibreNMS is a network monitoring system. In versions up to a…5.4
• CVE-2026-45695Kopia is a cross-platform backup tool for Windows, macOS, an…9.8
• CVE-2026-45696OpenEXR is the reference implementation and specification fo…6.5
• CVE-2026-45697Formie is a Craft CMS plugin for creating forms. Prior to 2.…9.8
• CVE-2026-45699Netatalk is a Free and Open Source file server suite for Uni…7.5
• CVE-2026-4570A vulnerability was identified in SourceCodester Sales and I…8.8
• CVE-2026-45700FreeRDP is a free implementation of the Remote Desktop Proto…9.8
• CVE-2026-45701Sulu is an open-source PHP content management system based o…6.9
• CVE-2026-45702OP-TEE is a Trusted Execution Environment (TEE) designed as …5.5
• CVE-2026-45703Pimcore is an Open Source Data & Experience Management Platf…6.4