Netatalk Spotlight RPC Unmarshaller Dead Bounds Check Vulnerability

A dead bounds check vulnerability has been identified in the Spotlight RPC unmarshaller of Netatalk versions 3.0.0 through 4.4.2. This flaw creates an unreachable code path that fails to provide effective bounds protection, potentially allowing a remote authenticated attacker to access limited information by sending crafted Spotlight RPC requests.

Impact

Exploitation of this vulnerability could lead to unauthorized information disclosure.

Remediation

Users can apply the patch named 'CVE-2026-44057,CVE-2026-44066.patch' to a Netatalk 4.4.2 source tree to hotfix their local Netatalk deployment. Alternatively, upgrading to Netatalk version 4.4.3 or later, which includes the patch, is recommended. Applying this patch is advisable for defense-in-depth, as it also addresses the related independently exploitable issue in CVE-2026-44066.