The vulnerability is a bug in the hextoint macro used by Netatalk between versions 2.0.0 and 4.4.2. The macro incorrectly handles uppercase hexadecimal characters, which can cause the value to be parsed incorrectly. This allows a remote authenticated attacker to send crafted hexadecimal input that results in limited data modification on the server. The weakness is identified as CWE-682 and the CVSS score of 3.1 indicates a low severity impact focused on data integrity rather than disclosure or execution.

Netatalk software, versions 2.0.0 through 4.4.2, used on Apple‑style servers and Unix‑based file sharing services. All installations running any of these versions are susceptible until the fix is applied.

The CVSS base score of 3.1 reflects a low‑risk condition. No exploitation reports are available and the EPSS value is not disclosed. The vulnerability is not listed in CISA’s KEV catalog, meaning no publicly known large‑scale attacks have leveraged it. Exploitation would require an attacker to send specially crafted data to the server to trigger the macro’s bug, which may result in a local mis‑interpretation of values or limited data modification. The risk remains mitigated by the absence of advanced attack vectors and the low score.