CVE-2026-7837CWE-367
TOCTOU with root privilege in ad_flush
Low · published May 21, 2026
What it is
A time-of-check time-of-use (TOCTOU) condition in the ad_flush function in Netatalk 3.0.0 through 4.4.2 involves root-privileged file operations, which may allow a remote attacker to cause limited data modification under specific race conditions.
The record
Technical detail
- CVSS v3.1
- 3.7 · LOW
- Vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
- CVSS v4.0
- Not supplied
- EPSS
- 0.00267 · 17.8th percentile
- Weakness
- CWE-367 · Time-of-check Time-of-use (TOCTOU) Race Condition
- Published
- 2026-05-21T08:14Z
EPSS history
Timeline