CVE-2026-63090
ProFTPD mod_sftp Heap Buffer Overflow via SFTP Packet Reassembly
CVSS Score
8.8
EPSS Score
0.0%
EPSS Percentile
0th
ProFTPD before 1.3.9c and 1.3.10rc3 contains a heap-based buffer overflow vulnerability in the mod_sftp module that allows authenticated low-privilege attackers to achieve arbitrary code execution by sending crafted SFTP packet fragments exceeding the 16 KB reassembly buffer in the fxp.c component. Attackers can supply oversized fragments to trigger an incorrectly conditioned reallocation, corrupt pool freelist metadata, overwrite the root_fs BSS global pointer to reference a fake filesystem struct, and redirect pr_fsio_stat() to system() via a crafted RENAME request.
| CWE | CWE-122 |
| Vendor | proftpd |
| Product | proftpd |
| Published | Jul 20, 2026 |
Stay Ahead of the Next One
Get instant alerts for proftpd proftpd
Be the first to know when new high vulnerabilities affecting proftpd proftpd are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Affected Versions
proftpd / proftpd
0 < 1.3.9c 1.3.10rc1 < 1.3.10rc3
References
github.com: https://github.com/proftpd/proftpd/blob/master/RELEASE_NOTES github.com: https://github.com/proftpd/proftpd/releases/tag/v1.3.10rc3-3 github.com: https://github.com/proftpd/proftpd/releases/tag/v1.3.9c github.com: https://github.com/proftpd/proftpd/issues/2190 github.com: https://github.com/proftpd/proftpd/commit/4ee8701bcf425f11b3b2116e634ff3e655d918b1 vulncheck.com: https://www.vulncheck.com/advisories/proftpd-mod-sftp-heap-buffer-overflow-via-sftp-packet-reassembly
Credits
Fabian Wahle with Hap Security