CVE-2026-63091

Name of the Vulnerable Software and Affected Versions ProFTPD versions prior to 1.3.9c ProFTPD versions prior to 1.3.10rc3

Description A signed integer overflow exists in the mod sftp module's SCP size-record parser. Authenticated low-privilege attackers can bypass ASLR (Address Space Layout Randomization, a security technique that randomizes memory addresses to prevent exploitation) by sending a crafted file size value of UINT64 MAX, resulting in a negative off t value. The subsequent conversion to uint32 t creates a requested read length of approximately 4 GB, forcing the server to read beyond the SSH channel data and write overread process memory into the uploaded file. This disclosure includes libc, libcrypto, and PIE pointers, allowing attackers to derive randomized base addresses and reliably exploit memory corruption vulnerabilities within the same process.

Recommendations Update to version 1.3.9c or later. Update to version 1.3.10rc3 or later.