Netatalk Security Advisory

Subject	NULL-pointer dereference in Spotlight CNID array handling
CVE ID#	CVE-2026-110780
Severity	Moderate
Disclosure Date	2026/10/15
Affected Versions	3.1.0-4.5.1
Summary	Spotlight RPC handlers access the first CNID array element without checking that the array is nonempty

Description

sl_rpc_fetchAttributeNamesForOIDArray(), sl_rpc_storeAttributesForOIDArray(), and sl_rpc_fetchAttributesForOIDArray() in etc/afpd/spotlight.c dereference an empty CNID array accepted by the unmarshaller, causing a NULL-pointer dereference (CWE-476). A crafted FPSpotlightRPC request with an outer CNID length greater than 16 and an inner count of zero triggers the crash. Exploitation requires Spotlight support to be built and enabled, and an authenticated client with an accessible volume open. Guest access is sufficient when the optional guest UAM and a guest-accessible volume are configured.

The crash terminates the afpd worker handling the connection. In the default configuration, each connection has its own child process, limiting the demonstrated denial of service to the attacker’s session. No memory write or code execution has been established.