CVE-2026-44062

HIGH 7.5

Published 2026-05-21 · Last modified 2026-05-22

A missing output length bounds check in pull_charset_flags() in Netatalk 2.0.4 through 4.4.2 allows a remote authenticated attacker to execute arbitrary code or cause a denial of service via crafted character set data.

ELEVATED IMPACT

Severe if exploited (CVSS 7.5), but no known exploitation and low modeled probability. Patch on a normal cadence.

Exploitation likelihood

0.4%chance of exploitation in 30 days · 28th percentile

○ In CISA KEV ○ Public exploit / PoC

Impact if exploited

7.5CVSS 3.1 · HIGH

ConfidentialityHigh
IntegrityHigh
AvailabilityHigh

What an attacker needs

✓Access: Reachable over the network — no local access needed
⚠Privileges: Requires a low-privilege account
✓User interaction: No user interaction needed
⚠Complexity: Needs a race window or specific setup

✓ lowers the bar for an attacker · ⚠ raises it

Affected

Vendors Netatalk

Products Netatalk

Weakness (CWE)

CWE-787: Out-of-bounds write

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

References

Advisories

https://netatalk.io/security/CVE-2026-44062 vendor-advisory

Sources: NVD · CVE.org · EPSS