A time‑of‑check time‑of‑use flaw in the Netatalk ad_flush function allows a remote attacker to perform limited data modifications when the code is executed with root privileges. The weakness involves root‑privileged file operations and is triggered only under specific race conditions, so the malicious outcome is not a full compromise but potentially destructive changes to files handled by the service.

Netatalk 3.0.0 through 4.4.2 is affected by this vulnerability. Any installation of these versions that runs the ad_flush functionality and is exposed to remote connections is at risk.

The CVSS score of 3.7 indicates low severity, and the EPSS score is not available, suggesting a low probability of exploitation. The flaw is not listed in the CISA KEV catalog. Exploitation requires an attacker to induce a race condition during a remote request that triggers ad_flush, which makes the attack complex and environment‑specific. While the impact is limited to data modification, it occurs with root privileges, raising the seriousness of the flaw even though widespread exploitation appears unlikely.