The vulnerability exists in Netatalk versions 2.2.5 through 4.4.2 and involves a race condition in the privilege toggle mechanism. A local attacker can exploit the non‑reentrant toggle to obtain limited system information, modify limited data, or trigger a minor service disruption. These effects are confined to the Netatalk process and do not grant broader privilege escalation, but they may facilitate further attacks if additional information or state is compromised.

The affected vendor is Netatalk. The vulnerability impacts all releases from version 2.2.5 up to and including 4.4.2. No specific patched version is currently documented in the CVE data.

The CVSS score of 3.9 indicates low overall severity. No EPSS data is available and the vulnerability is not listed in the CISA KEV catalog. Attackers would need local access to the Netatalk service to trigger the race condition, and success yields only modest information disclosure, data modification, or service disruption rather than full privilege escalation.