CVE-2026-44050 -- CVSS 9.9 Vulnerability Briefing

CVE-2026-44050 | CVSS 9.9 (Critical) | Exploit: No known exploit

What Is It

CVE-2026-44050 is a heap-based buffer overflow vulnerability in the CNID (Catalog Node ID) daemon within Netatalk, an open-source AFP (Apple Filing Protocol) server implementation, affecting versions 2.0.0 through 4.4.2.

Technical Detail

The flaw resides in the comm_rcv() function of the Netatalk CNID daemon, where insufficient bounds checking on received data allows a heap buffer to be overwritten with attacker-controlled content. A remote attacker with valid authentication credentials can trigger this condition by sending a malformed or oversized message to the CNID daemon, corrupting heap memory in a manner that can redirect execution flow. Successful exploitation can result in arbitrary code execution with escalated privileges on the host system, given that the CNID daemon may run with elevated permissions.

Exploitation Status

No known exploit code has been observed or publicly disclosed as of May 28, 2026. This vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities catalog. Despite the absence of confirmed exploitation, the critical CVSS score of 9.9 and the nature of the flaw warrant proactive remediation without waiting for exploit activity to materialize.

Who Is Targeting This

No specific threat actor attribution at this time. Neither confirmed nor reported threat actor activity has been associated with CVE-2026-44050 in available intelligence sources.

What To Do

Administrators running any Netatalk instance in the affected version range (2.0.0 through 4.4.2) should prioritize patching to the latest available release that addresses this vulnerability. If an immediate patch cannot be applied, consider restricting network access to the CNID daemon port (typically TCP 4700) to trusted hosts only, and enforce strict authentication controls to limit the pool of users who can reach the service. Monitor CNID daemon logs for anomalous or malformed connection attempts as a detection signal. Given the authentication requirement, auditing and reducing the number of accounts with AFP access is a practical interim risk reduction measure.