CVE-2026-63090

Name of the Vulnerable Software and Affected Versions ProFTPD versions prior to 1.3.9c ProFTPD versions prior to 1.3.10rc3

Description A heap-based buffer overflow exists in the mod sftp module within the fxp.c component. Authenticated low-privilege attackers can achieve arbitrary code execution by sending crafted SFTP packet fragments that exceed the 16 KB reassembly buffer. This occurs when oversized fragments trigger an incorrectly conditioned reallocation, allowing the attacker to corrupt pool freelist metadata and overwrite the root fs BSS global pointer to reference a fake filesystem struct. Consequently, the attacker can redirect the pr fsio stat() function to system() by sending a crafted RENAME request.

Recommendations Update to version 1.3.9c or later. Update to version 1.3.10rc3 or later.