CVE-2018-1160: Netatalk dsi_opensess.c out-of-bounds write allows remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityCVSS 9.8 with remote unauthenticated code execution, public exploits, and an EPSS probability above 0.86 make this an urgent patching priority.

What it is

Netatalk before 3.1.12 fails to bounds-check attacker-controlled data in dsi_opensess.c, producing an out-of-bounds write. A remote unauthenticated attacker can exploit this to achieve arbitrary code execution on the affected service. The flaw is rated critical (CVSS 3.1 9.8) and affects Netatalk as well as bundled copies in Synology and Debian products.

Impact

An attacker gains arbitrary code execution in the context of the Netatalk service, which typically runs with elevated privileges on NAS and file-sharing appliances. This can lead to full compromise of the host and any data it stores.

Attack surface

The vulnerability is reachable over the network via the Netatalk/AFP service with no authentication and no user interaction required, per the CVSS vector AV:N/AC:L/PR:N/UI:N. Any exposed Netatalk endpoint is a candidate target.

Exploitation

Multiple public exploits exist (Exploit-DB 46034, 46048, 46675; Packet Storm and Tenable references), and EPSS is 0.865 with a 0.997 percentile, indicating very high likelihood of exploitation. CISA KEV does not list it, and no ransomware groups are documented using it in this record.

What to do

• Upgrade Netatalk to 3.1.12 or later, and apply the corresponding Synology and Debian security updates.
• If patching is not immediately possible, restrict network access to the Netatalk/AFP service to trusted hosts only.
• Disable or stop the Netatalk service on systems that do not require AFP file sharing.
• Segment NAS and file-sharing appliances from untrusted networks and monitor for anomalous outbound connections.
• Verify third-party or embedded Netatalk copies (for example in NAS firmware) are updated, not just the OS package.

Detection

• Monitor Netatalk/AFP service logs for malformed or oversized DSI OpenSession requests and crashes.
• Alert on unexpected process crashes or restarts of afpd/netatalk daemons.
• Hunt for known exploit payloads or shellcode patterns in network traffic to the AFP port.
• Watch for post-exploitation behavior such as new processes, reverse shells, or unusual outbound connections from NAS devices.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.