The vulnerability is an out-of-bounds read in the ASP session ID handling of Netatalk 1.3 through 4.4.2. By sending a crafted ASP request with a session ID that exceeds the expected bounds, an attacker can read adjacent memory and thus obtain limited information or trigger a denial of service. This represents the classic out-of-bounds read weakness identified as CWE‑125. The consequences are potential information disclosure or service disruption, but it does not lead to arbitrary code execution.

Affected products include Netatalk 1.3 and all releases through 4.4.2. The vulnerability resides in the ASP session handling component of Netatalk, which is used to provide file‑sharing services over the network. Any deployment of Netatalk within this version range is potentially impacted.

The CVSS score of 7.1 indicates moderate to high severity. No EPSS data is available to gauge current exploitation probability. The flaw is not listed in CISA KEV. The likely attack vector is remote, as ASP session IDs are transmitted by clients. Exploitation would involve sending a crafted ASP request with a session ID that exceeds expected bounds, allowing the attacker to read adjacent memory and extract limited information or trigger a denial of service. Exploitation requires the attacker to directly control the session identifier supplied to the Netatalk server, implying a need for network access to the affected instance.