What this actually is.
Technical background, root cause, and affected surface.
A dead bounds check in the Spotlight RPC unmarshaller in Netatalk 3.0.0 through 4.4.2 results in an unreachable code path that provides no effective bounds protection, which may allow a remote authenticated attacker to obtain limited information via crafted Spotlight RPC requests.
- Vendor
- Netatalk
- Product
- Netatalk
- Severity
- Low
- CVSS Score
- 3.1
- Status
- Published
- CWE
- CWE-561: Dead Code
- Vector
- CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
From one request
to root shell.
Reproduced in a sandboxed environment. Requires only LAN or WiFi adjacency.
The bug, and the fix.
afpd/spotlight_rpc.c or spotlight.c: bounds check condition after unconditional return or in unreachable branch in Spotlight RPC parsing
Root cause: Bounds check placed in unreachable code path (dead code), likely due to refactoring error
When does this fire?
All conditions must be true for the exploit to succeed.
Authenticated AFP client sends crafted Spotlight RPC requests to a Netatalk server with Spotlight enabled
What an attacker does to you.
Post-exploitation outcomes mapped to CVSS impact metrics.
Limited information disclosure via Spotlight RPC due to missing effective bounds protection
C:L · I:N · A:N
CWE-561: Dead Code
Fix it. In this order.
A runbook, not a checklist. Sequence matters — assume compromise before you act.
Upgrade to Netatalk 4.4.3 which removes the dead code and adds effective bounds checking in the correct location.
disclose@securin.ioVendors moved in days.
Attackers in hours.
Reconstructed from vendor advisories, CISA bulletins, and Securin research records.
Vendor notified
Netatalk 4.4.3 patch released
CVE published to MITRE
Disclosed 60 days after discovery
Cite, verify, go deeper.
Primary sources — NVD, CISA KEV, and machine-readable IoC feed.