The vulnerability is an out-of-bounds write caused by a missing output length bounds check on the 'o_len' parameter in the pull_charset_flags() function of Netatalk versions 2.0.4 through 4.4.2. A remote authenticated attacker can send specially crafted character set data to trigger the flaw, potentially allowing arbitrary code execution or causing a denial of service. This mismatch is classified as CWE-787 and means that successful exploitation could compromise confidentiality, integrity, and availability of the affected system.

Affected are Netatalk installations from version 2.0.4 through 4.4.2, provided by the Netatalk project. No specific fix version is listed; organizations should reference the vendor to determine the patched release.

The CVSS score of 7.5 indicates a high severity; the EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, so public exploitation is not yet documented. Nevertheless, an authenticated attacker who accesses the Netatalk service could exploit the flaw via network. The lack of bounds checking also suggests that accidental exploitation is possible if malformed input is processed.