ProFTPD before 1.3.9c and 1.3.10rc3 contains a heap-based buffer overflow vulnerability in the mod_sftp module that allows authenticated low-privilege attackers to achieve arbitrary code execution by sending crafted SFTP packet fragments exceeding the 16 KB reassembly buffer in the fxp.c component. Attackers can supply oversized fragments to trigger an incorrectly conditioned reallocation, corrupt pool freelist metadata, overwrite the root_fs BSS global pointer to reference a fake filesystem struct, and redirect pr_fsio_stat() to system() via a crafted RENAME request.
Metrics
Affected Vendors & Products
| Vendors | Products |
|---|---|
| Proftpd |
|
No data.
No data.
References
History
Tue, 21 Jul 2026 02:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Proftpd
Proftpd proftpd |
|
| Vendors & Products |
Proftpd
Proftpd proftpd |
Mon, 20 Jul 2026 14:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | ProFTPD before 1.3.9c and 1.3.10rc3 contains a heap-based buffer overflow vulnerability in the mod_sftp module that allows authenticated low-privilege attackers to achieve arbitrary code execution by sending crafted SFTP packet fragments exceeding the 16 KB reassembly buffer in the fxp.c component. Attackers can supply oversized fragments to trigger an incorrectly conditioned reallocation, corrupt pool freelist metadata, overwrite the root_fs BSS global pointer to reference a fake filesystem struct, and redirect pr_fsio_stat() to system() via a crafted RENAME request. | |
| Title | ProFTPD mod_sftp Heap Buffer Overflow via SFTP Packet Reassembly | |
| Weaknesses | CWE-122 | |
| References |
|
|
| Metrics |
cvssV3_1
|
MITRE
Status: PUBLISHED
Assigner: VulnCheck
Published: 2026-07-20T14:22:03.712Z
Updated: 2026-07-20T14:22:03.712Z
Reserved: 2026-07-15T15:45:44.600Z
Link: CVE-2026-63090
Vulnrichment
No data.
NVD
No data.
Redhat
No data.