{"apiVersion":"1.0","identifier":"CVE-2026-45699","description":"Netatalk is a Free and Open Source file server suite for Unix-like operating systems. In versions 3.1.19 through 4.4.2, a stack-based buffer overflow exists in the copydir() function of Netatalk-s afpd daemon due to an integer underflow in the calculation of the remaining buffer size used for path construction. copydir() is a utility function called when a file operation crosses a device boundary inside an AFP shared volume, which the standard library-s renameat() cannot handle. The function attempts to track available buffer space using srem and drem for source and destination paths. Incorrect arithmetic causes both srem and drem to underflow to SIZE_MAX. Consequently, boundary checks against strlen(de->d_name) always pass, allowing strcpy() to append filenames into nearly full stack buffers. Version 4.4.3 patches the issue. As a workaround, configure each AFP shared volume to be structured as a single file system, in other words no subdirectory of a shared volume should be a mount point for a different file system.","publishedAt":"2026-08-14T19:17:18","lastModifiedAt":"2026-08-18T02:17:26","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-45699","cvssScore":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","epssProbability":0.00335,"riskScore":0.77,"affectedProduct":"Netatalk","affectedVersions":">=3.1.19,<=4.4.2","vulnerabilityType":"Library","operatingSystems":[],"links":{"self":"https://www.redsauce.net/api/cves/CVE-2026-45699","webPages":{"es":"https://www.redsauce.net/es/cves/CVE-2026-45699","en":"https://www.redsauce.net/en/cves/CVE-2026-45699","fr":"https://www.redsauce.net/fr/cves/CVE-2026-45699","pt":"https://www.redsauce.net/pt/cves/CVE-2026-45699","de":"https://www.redsauce.net/de/cves/CVE-2026-45699","sk":"https://www.redsauce.net/sk/cves/CVE-2026-45699","el":"https://www.redsauce.net/el/cves/CVE-2026-45699"},"source":"https://nvd.nist.gov/vuln/detail/CVE-2026-45699"}}