A dead bounds check in the Spotlight RPC unmarshaller of Netatalk leads to an unreachable code path that removes all effective bounds protection. This flaw allows a remote authenticated attacker to craft special Spotlight RPC requests and obtain limited information. The weakness is identified as CWE-561, representing dead code that can produce unintended behavior. The principal security consequence is information disclosure.

Netatalk version 3.0.0 through 4.4.2 are affected. All instances of these releases can potentially be exploited by attackers who have legitimate or compromised credentials against the service.

The CVSS score of 3.1 categorizes this vulnerability as low to moderate. EPSS is not available, and it is not listed in the CISA KEV catalog, suggesting limited exploitation data. Based on the description, the attack requires an authenticated session to the Netatalk server; the attacker must send crafted RPC requests to trigger the misuse of the dead bounds check. While the exploit could provide only limited data, it may still aid reconnaissance activities.