Netatalk versions 3.1.2 through 4.4.2 include a build configuration that disables the compile‑time flag FORTIFY_SOURCE, which turns off the runtime buffer overflow detection normally provided by the C standard library. Without this safety net, a malicious remote user can craft input that triggers memory corruption conditions that would ordinarily be intercepted and safely terminated, instead leading to a crash or service reset and thus a minor denial of service. The vulnerability is a weakness in the program’s control over memory operations, as classified by CWE‑693.

The vendor is Netatalk, and the affected product range is Netatalk 3.1.2 up to and including 4.4.2. No sub‑product or additional vendor details are listed. Any deployment of these versions that exposes the Netatalk service over a network is potentially impacted.

The CVSS v3.10 score of 3.7 indicates low severity, and no EPSS data is available, so the current public exploitation probability is unknown. The vulnerability is not listed in the CISA KEV catalog, which further suggests that active, publicly known exploits are not in circulation. The likely attack vector is from a remote host that can interact with the Netatalk service; the attacker would need to send specially crafted data to trigger the memory error, causing the service to stop and resulting in a disruption of availability. No privilege escalation or data‑exfiltration capability is described, so the impact is limited to disruption rather than compromise.