Netatalk Security Advisory

Subject	Heap out-of-bounds read in Spotlight CNID array handling
CVE ID#	CVE-2026-110779
Severity	Moderate
Disclosure Date	2026/10/15
Affected Versions	3.1.0-4.5.1
Summary	Spotlight query array elements are copied without validating their type or allocation size

Description

sl_createCNIDArray() in etc/afpd/spotlight.c copies eight bytes from each kMDQueryItemArray element without checking its talloc type or allocation size. A crafted FPSpotlightRPC request containing shorter elements can trigger a heap out-of-bounds read. Exploitation requires Spotlight support to be built and enabled, and an authenticated client with an accessible volume open. Guest access is sufficient when the optional guest UAM and a guest-accessible volume are configured.

The resulting value is used as an internal CNID filter and is not returned to the client; information disclosure has not been established. A production crash has not been demonstrated. No write primitive or remote code execution has been established.