Cyber Resilience

CVE-2026-44071

Low

Published: 21 May 2026

Published
21 May 2026
Modified
21 May 2026
KEV Added
—
Patch
—
CVSS Score v3.1 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
EPSS Score 0.0016 37.1th percentile
Risk Priority 7 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-44071 is a low-severity Protection Mechanism Failure (CWE-693) vulnerability in Netatalk (inferred from references). Its CVSS base score is 3.7 (Low).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 37.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

Netatalk 3.1.2 through 4.4.2 is compiled without FORTIFY_SOURCE, which disables built-in buffer overflow detection at runtime, potentially allowing a remote attacker to cause a minor denial of service via memory errors that would otherwise be caught and safely terminated by…

more

runtime protection.

CWE(s)
CWE-693

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1499.004 Application or System Exploitation Impact
Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.
attack.mitre.org →
Why these techniques?

Missing FORTIFY_SOURCE allows remote exploitation of memory errors in public-facing Netatalk service, directly enabling application-layer DoS via exploitation.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

Affected Assets

Netatalk
—
inferred from references and description; NVD did not file a CPE for this CVE

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

AC-25 Reference Monitor
addresses: CWE-693

Implements a reliable, tamperproof protection mechanism whose completeness can be assured.

AT-1 Policy and Procedures
addresses: CWE-693

Procedures for training on protection mechanisms reduce the chance of protection mechanism failures being present or exploitable.

CA-1 Policy and Procedures
addresses: CWE-693

Documented procedures to implement assessment, authorization, and monitoring controls prevent these protection mechanisms from failing due to undefined processes.

CA-2 Control Assessments
addresses: CWE-693

Direct evaluation of whether controls produce desired security outcomes detects protection mechanism failures and enables remediation.

CA-4 Security Certification
addresses: CWE-693

Requires assessment that protection mechanisms are correctly implemented and producing intended security outcomes.

CA-5 Plan of Action and Milestones
addresses: CWE-693

The POA&M process ensures identified weaknesses in protection mechanisms are documented and scheduled for remediation, reducing the duration they remain exploitable.

CA-7 Continuous Monitoring
addresses: CWE-693

Ongoing control assessments and analysis of monitoring data enable timely detection and response when protection mechanisms fail.

CM-4 Impact Analyses
addresses: CWE-693

Impact analysis identifies changes that could weaken or disable existing protection mechanisms.

References