CVE-2026-44057
LowCVSS 3.1Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
In Netatalk versions 3.0.0 through 4.4.2, a dead bounds check in the Spotlight RPC unmarshaller provides no effective bounds protection, potentially allowing a remote authenticated attacker to obtain limited information via crafted Spotlight RPC requests.
Risk Assessment
The risk is limited information disclosure by a remote authenticated attacker, potentially compromising data confidentiality.
Recommendation
Update Netatalk to version 4.4.3 or later, which fixes the dead bounds check.
Original NVD description (English source)
A dead bounds check in the Spotlight RPC unmarshaller in Netatalk 3.0.0 through 4.4.2 results in an unreachable code path that provides no effective bounds protection, which may allow a remote authenticated attacker to obtain limited information via crafted Spotlight RPC requests.