CVE-2026-45699

Name of the Vulnerable Software and Affected Versions Netatalk versions 3.1.19 through 4.4.2

Description A stack-based buffer overflow exists in the copydir() function of the afpd daemon. This occurs due to an integer underflow when calculating the remaining buffer size for path construction. The copydir() function is used during file operations that cross device boundaries within an AFP shared volume, a scenario that the standard library's renameat() function cannot manage. The process uses srem and drem variables to track available space for source and destination paths; however, incorrect arithmetic causes these variables to underflow to SIZE MAX. This results in boundary checks for strlen(de->d name) always passing, which allows strcpy() to append filenames into nearly full stack buffers.

Recommendations Update to version 4.4.3. Configure each AFP shared volume to be structured as a single file system, ensuring no subdirectory of a shared volume is a mount point for a different file system.