CVE-2026-44050 | A heap-based buffer overflow in the CNID daemon comm_rcv() f… | CVSS 9.9 CRITICAL

Description

A heap-based buffer overflow in the CNID daemon comm_rcv() function in Netatalk 2.0.0 through 4.4.2 allows a remote authenticated attacker to execute arbitrary code with escalated privileges or cause a denial of service.

Metadata

CVE ID: CVE-2026-44050
State: PUBLISHED
Assigner: securin
Reserved: 2026-05-05 07:24 UTC
Published: 2026-05-21 07:34 UTC
Last updated: 2026-05-22 03:56 UTC
Primary CWE: CWE-122
Heap-based Buffer Overflow
Vendor / Product: Netatalk / Netatalk
Sources: cve.org · NVD

Severity & Metrics

9.9 CRITICAL CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

SSVC — CISA Coordinator

Exploitation: none
Automatable: no
Tech. Impact: total

Affected products (1)

Vendor	Product	Platform	Versions
Netatalk	Netatalk	—	2.0.0 ≤ 4.4.2, 4.4.3

Weakness (CWE)

CWE	Source	Description
CWE-122	cna	Heap-based Buffer Overflow

CVSS scores (1)

Score	Severity	Version	Source	Vector
9.9	CRITICAL	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

References (1)

Netatalk Security Advisory CVE-2026-44050 https://netatalk.io/security/CVE-2026-44050