CVE-2026-7835: Format String Vulnerability in Netatalk

CVE-2026-7835 is a format string vulnerability in Netatalk affecting versions prior to 4.4.3. It arises from a mismatch between format specifiers and argument types in logging functions, which could lead to stack memory disclosure or daemon instability. The vulnerability can be triggered by an authenticated AFP client under specific conditions. While the risk of exploitation is considered low, it is recommended to upgrade to Netatalk 4.4.3 or later to mitigate the issue. The Netatalk team has released a patch, but they do not encourage applying it proactively due to low exploitability. The vulnerability was reported by Arjun Basnet from Securin and Daniel Markstedt from the Netatalk team. The CVSS score for this vulnerability is 3.1, indicating low impact.

Key Points: • CVE-2026-7835 affects Netatalk versions prior to 4.4.3 due to format string mismatches. • Exploitation requires an authenticated AFP client, but practical attack vectors are limited. • Upgrade to Netatalk 4.4.3 or apply the patch to mitigate the vulnerability.