A format string function call in Netatalk has a mismatch between the format specifier and the argument type or count. This can cause the function to read unintended values from the stack, potentially disclosing stack memory contents.
Reproduced in a sandboxed environment. Requires only LAN or WiFi adjacency.
afpd or libatalk: LOG() or printf-family call with mismatched format string arguments (e.g., %s used with integer argument)
Root cause: Format string specifier does not match the type of the corresponding argument in a printf-family or LOG() call
All conditions must be true for the exploit to succeed.
Authenticated AFP client triggers the code path containing the mismatched format string call
Post-exploitation outcomes mapped to CVSS impact metrics.
Limited stack memory disclosure via format string argument mismatch; potential daemon instability
A runbook, not a checklist. Sequence matters — assume compromise before you act.
Upgrade to Netatalk 4.4.3 which corrects all format string argument mismatches. Build with -Wformat -Wformat-security to detect future issues.
Reconstructed from vendor advisories, CISA bulletins, and Securin research records.
Timeline recorded · Disclosure coordinated by Securin
Primary sources — NVD, CISA KEV, and machine-readable IoC feed.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
