The vulnerability manifests as a heap over‑read in Netatalk’s extended attribute (EA) header parsing. A remote, authenticated attacker can supply crafted EA data that causes the parser to read memory beyond the intended boundary, resulting in the disclosure of limited internal data or a minor service disruption. The weakness is represented by CWE‑125, which highlights improper bounds checking in memory operations.

Netatalk versions 2.1.0 through 4.4.2 are impacted. Any deployment running those releases without a corrective update is susceptible to the described flaw. The exact patch level that resolves the issue is not specified in the advisory.

The CVSS score of 3.7 indicates a low severity. Because the EPSS score is not provided and the vulnerability is not listed in the CISA KEV catalog, the likelihood of exploitation remains uncertain. The flaw requires the attacker to be authenticated with the Netatalk server and to trigger EA header parsing as part of normal client activity. There is no evidence of remote code execution or privilege escalation; the primary consequence is limited information disclosure, with the possible secondary impact of a brief disruption.