CVE 2026 44064

netatalk.io • July 16, 2026

Legacy ASP/DDP session handling can use an attacker-controlled session identifier without adequate validation. When ASP/DDP support is built and enabled, an unauthenticated network attacker may be able to crash the service; reliable code execution is less certain.

Apply CVE-2026-44064.patch to a Netatalk 4.4.2 source tree to hotfix your local Netatalk deployment.

Alternatively, upgrade to Netatalk 4.4.3 or later, which includes the patch.

Netatalk administrators are advised to upgrade to this version or apply the patch as soon as possible.

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H (7.1)

Restrict legacy AppleTalk access to trusted networks until patched, or disable ASP/DDP support if not needed.

Vulnerability reported by:

Arjun Basnet from Securin

Daniel Markstedt of the Netatalk team

Go back to the Security Policy .

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

CVE-2026-44064: Out-of-Bounds Access Vulnerability in Netatalk ASP CVE-2026-44064 affects Netatalk's handling of AppleTalk Session Protocol (ASP) session IDs, allowing an unauthenticated attacker on the same local network to exploit an out-of-bounds access vulnerability. This flaw can lead to process memory disclosure or a denial of service (DoS) by crashing the daemon. The vulnerability arises from a lack of bounds checking on the session ID used as an array index. Netatalk administrators are advised to upgrade to version 4.4.3 or apply a patch to mitigate the risk. The vulnerability was disclosed on May 21, 2026, and has been reproduced in a controlled environment. The CVSS score for this vulnerability is 7.1, indicating a high severity level. Security advisories recommend restricting legacy AppleTalk access until a patch is applied. 2 sources 65

Extracted Entities

CVE 2026 44064

The full story

Extracted Entities

Companies (2)

CVEs (1)

Platforms (1)