CVE-2026-44048

EUVD-2026-31225
A stack-based buffer overflow via UCS-2 type confusion in convert_charset() in Netatalk 2.0.4 through 4.4.2 allows a remote authenticated attacker to execute arbitrary code or cause a denial of service.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
securinCNA
8.8 HIGH
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 35.09%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
netatalknetatalk
2.0.4 ≤
𝑥
≤ 4.4.2
CNA
Debian logo
Debian Releases
Debian Product
Codename
netatalk
bullseye
vulnerable
bullseye (security)
vulnerable
forky
4.5.1~ds-1
fixed
sid
4.5.1~ds-1
fixed
trixie
4.2.3~ds-1+deb13u2
fixed
trixie (security)
4.2.3~ds-1+deb13u2
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
netatalk
bionic
Fixed 2.2.6-1ubuntu0.18.04.2+esm3
released
focal
Fixed 3.1.12~ds-4ubuntu0.20.04.4+esm1
released
jammy
Fixed 3.1.12~ds-9ubuntu0.22.04.4+esm1
released
noble
Fixed 3.1.18~ds-1ubuntu0.1~esm2
released
questing
ignored
resolute
Fixed 4.2.3~ds-2.1ubuntu0.1
released
trusty
Fixed 2.2.2-1ubuntu2.2+esm3
released
Common Weakness Enumeration
References
https://netatalk.io/security/CVE-2026-44048