CVE-2026-7837
Deferred Deferred - Pending Action
Time-of-Check Time-of-Use Race Condition in Netatalk

Publication date: 2026-05-21

Last updated on: 2026-05-21

Assigner: securin

Description
A time-of-check time-of-use (TOCTOU) condition in the ad_flush function in Netatalk 3.0.0 through 4.4.2 involves root-privileged file operations, which may allow a remote attacker to cause limited data modification under specific race conditions.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-05-21
Last Modified
2026-05-21
Generated
2026-06-10
AI Q&A
2026-05-21
EPSS Evaluated
2026-06-09
NVD
CVE-2026-7837
EUVD
EUVD-2026-31245
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
netatalk netatalk From 3.0.0 (inc) to 4.4.2 (inc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-367 The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability is a time-of-check time-of-use (TOCTOU) condition found in the ad_flush function of Netatalk versions 3.0.0 through 4.4.2. It involves root-privileged file operations, which means that under certain race conditions, a remote attacker could exploit the timing issue to cause limited modification of data.

Impact Analysis

The vulnerability may allow a remote attacker to cause limited data modification. This means that an attacker could potentially alter some data on the affected system without authorization, although the impact is limited and does not affect confidentiality or availability.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-7837. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart