Out-of-bounds read in Netatalk - CVE-2026-110779
Published: November 9, 2026
Vulnerability identifier: #VU162851
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-110779
CWE-ID: CWE-125
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an authenticated remote attacker to trigger a heap out-of-bounds read in Netatalk.
The vulnerability exists due to missing element type and size validation when Spotlight copies eight bytes from each item in a mixed-type query array. An authenticated remote attacker can submit short elements through Spotlight RPC when Spotlight is built and enabled and an accessible volume is open, with unauthenticated exploitation also possible through optional guest authentication and a guest-accessible volume.
Affected software
Netatalk
How to mitigate CVE-2026-110779
Install security update from vendor's website.
Netatalk - update to 4.5.2