CVE-2026-67192

Name of the Vulnerable Software and Affected Versions Xlight FTP Server versions prior to 3.9.5

Description A pre-authentication stack buffer overflow occurs when a GCM cipher is negotiated. Unauthenticated attackers can corrupt stack memory by sending malformed SSH packets containing an unvalidated length field. This field is passed directly to the GCM decrypt function, allowing the overwriting of the stack cookie and return address, which can lead to remote code execution.

Recommendations Update Xlight FTP Server to version 3.9.5 or later.