Out-of-bounds write in Netatalk - CVE-2026-62321
Published: November 9, 2026
Vulnerability identifier: #VU162848
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-62321
CWE-ID: CWE-787
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an authenticated remote attacker to corrupt heap memory in Netatalk's AFP server.
The vulnerability exists due to incorrect buffer capacity checks in the afpd Spotlight RPC reply marshaller when serializing nested file metadata into a partially filled reply buffer. An authenticated remote attacker can submit a crafted Spotlight query on a Spotlight-enabled AFP volume to generate oversized metadata and write beyond the heap-allocated reply buffer.
Affected software
Netatalk
How to mitigate CVE-2026-62321
Install security update from vendor's website.
Netatalk - update to 4.5.1