What this actually is.
Technical background, root cause, and affected surface.
Multiple heap out-of-bounds reads in the Spotlight RPC unmarshalling code in Netatalk 3.1.0 through 4.4.2 allow a remote authenticated attacker to obtain sensitive information or cause a minor service disruption.
- Vendor
- Netatalk
- Product
- Netatalk
- Severity
- High
- CVSS Score
- 7.1
- Status
- Published
- CWE
- CWE-125: Out-of-bounds Read
- Vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L
From one request
to root shell.
Reproduced in a sandboxed environment. Requires only LAN or WiFi adjacency.
The bug, and the fix.
afpd/spotlight_rpc.c: multiple locations in RPC message parsing where buffer read position is not validated against message boundary
Root cause: Insufficient bounds checking on read operations during Spotlight RPC message parsing
When does this fire?
All conditions must be true for the exploit to succeed.
Authenticated AFP client sends crafted Spotlight RPC messages with manipulated length fields or message structure
What an attacker does to you.
Post-exploitation outcomes mapped to CVSS impact metrics.
Heap memory disclosure (potentially exposing sensitive data) or daemon crash (DoS)
C:H · I:N · A:L
CWE-125: Out-of-bounds Read
Fix it. In this order.
A runbook, not a checklist. Sequence matters — assume compromise before you act.
Upgrade to Netatalk 4.4.3 which adds comprehensive bounds checking throughout the Spotlight RPC unmarshaller.
disclose@securin.ioVendors moved in days.
Attackers in hours.
Reconstructed from vendor advisories, CISA bulletins, and Securin research records.
Vendor notified
Netatalk 4.4.3 patch released
CVE published to MITRE
Disclosed 60 days after discovery
Cite, verify, go deeper.
Primary sources — NVD, CISA KEV, and machine-readable IoC feed.