Netatalk versions 3.0.0 through 4.4.2 contain an integer underflow in the volxlate function. The flaw allows a local privileged user to craft volume translation requests that trigger an underflow, leading to incorrect calculations. This can expose limited information, permit modification of limited data, or cause a minor service disruption. The vulnerability is represented by CWE‑191 and does not provide arbitrary code execution, but it can degrade service reliability for users with local administrative privileges.

This vulnerability affects the Netatalk server software by Netatalk, specifically versions 3.0.0 through 4.4.2. All earlier releases and those beyond 4.4.2 are not impacted.

The assigned CVSS score of 3.4 rates the issue as low severity, and the EPSS score is not available. The vulnerability is not listed in CISA’s KEV catalog. The flaw can only be triggered by a local privileged user who can send crafted volume translation requests to the Netatalk service, thereby inducing the underflow. While it does not provide arbitrary code execution, such a local attacker could read limited information, alter limited data, or cause a minor service disruption.