Netatalk Security Advisory
| Subject | Out-of-bounds write in AppleDouble sidecar reads |
|---|---|
| CVE ID# | CVE-2026-103933 |
| Severity | High |
| Disclosure Date | 2026/10/15 |
| Affected Versions | 2.1.0-4.5.1 |
| Summary | A crafted FPGetExtAttr request can overflow the reply buffer when a malformed AppleDouble sidecar is present |
Description
On volumes using the AppleDouble backend (ea = ad, or when automatic detection selects it),
afpd does not reject an undersized FPGetExtAttr reply limit before reading an attribute.
If the target file has a malformed AppleDouble sidecar with an oversized attribute,
an authenticated AFP client can trigger an out-of-bounds write.
This may crash the worker process or allow arbitrary code execution,
potentially with root privileges on deployments that start afpd as root.
Exploitation requires the malformed sidecar to be present.
It may be introduced through local filesystem access, another file-sharing protocol,
or an import or restore process. An AFP-only method to create the required sidecar has not been identified.
Volumes using the filesystem extended attribute backend (ea = sys) are not affected by this code path.
Patch Availability
Upgrade to Netatalk 4.5.2 or later which includes the fix.
CVSS Calculation
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Workaround
The default backend is filesystem extended attributes (ea = sys),
which is not affected by this vulnerability.
If the filesystem does not support extended attributes, you can explicitly disable AppleDouble extended attribute support in afp.conf:
[Global]
ea = none
Credits
Vulnerability reported by:
Alejandro Ramos aramosf@gmail.com
Patch developed by:
Daniel Markstedt of the Netatalk team
References
Go back to the Security Policy.