CVE-2026-45698

Name of the Vulnerable Software and Affected Versions Netatalk versions 3.1.19 through 4.4.2

Description A stack-based buffer overflow exists in the deletedir() function of the afpd daemon. This occurs due to an integer underflow when calculating the remaining buffer size for path construction. The deletedir() function is used during file operations that cross device boundaries within an AFP shared volume, where the standard renameat() function is insufficient. An unsigned integer underflow causes the remain variable to reach its maximum value, bypassing boundary checks and allowing an unbounded strcpy() operation to copy attacker-controlled filenames into a stack buffer.

Recommendations Update to version 4.4.3.