NULL pointer dereference in Netatalk - CVE-2026-110780
Published: November 9, 2026
Vulnerability identifier: #VU162852
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-110780
CWE-ID: CWE-476
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated remote attacker to crash their Netatalk afpd connection process when guest AFP access is enabled.
The vulnerability exists due to missing element-count checks in Spotlight RPC handlers for CNID arrays with an outer length greater than 16 and zero entries. An unauthenticated remote attacker can send a crafted Spotlight RPC request to trigger a NULL-pointer dereference, causing denial of service limited to their own session in the default configuration.
Affected software
Netatalk
How to mitigate CVE-2026-110780
Install security update from vendor's website.
Netatalk - update to 4.5.2