What this actually is.
Technical background, root cause, and affected surface.
The dsi_writeinit() function in Netatalk's DSI (Data Stream Interface) layer performs an arithmetic operation that can underflow when processing a crafted DSI write request. A pre-authentication attacker can send a malformed DSI write command causing a negative length calculation, crashing the daemon.
- Vendor
- Netatalk
- Product
- Netatalk
- Severity
- High
- CVSS Score
- 7.5
- Status
- Published
- CWE
- CWE-191: Integer Underflow (Wrap or Wraparound)
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
From one request
to root shell.
Reproduced in a sandboxed environment. Requires only LAN or WiFi adjacency.
The bug, and the fix.
libatalk/dsi/dsi_write.c: dsi_writeinit() - length calculation from DSI header fields without underflow protection
Root cause: Missing unsigned integer underflow check in DSI write length computation before use
When does this fire?
All conditions must be true for the exploit to succeed.
Unauthenticated attacker sends a crafted DSI write request with header fields that produce an integer underflow in the length calculation
What an attacker does to you.
Post-exploitation outcomes mapped to CVSS impact metrics.
AFP daemon crash causing complete denial of service to all connected AFP clients
Fix it. In this order.
A runbook, not a checklist. Sequence matters — assume compromise before you act.
Upgrade to Netatalk 4.4.3 which adds length validation before the arithmetic operation in dsi_writeinit().
disclose@securin.ioVendors moved in days.
Attackers in hours.
Reconstructed from vendor advisories, CISA bulletins, and Securin research records.
2026-05-13: Netatalk 4.4.3 patch released | 2026-05-21: CVE published to MITRE
Timeline recorded · Disclosure coordinated by Securin
Cite, verify, go deeper.
Primary sources — NVD, CISA KEV, and machine-readable IoC feed.