Buffer overflow in Proftpd
CVE-2026-63090
ProFTPD before 1.3.9c and 1.3.10rc3 contains a heap-based buffer overflow vulnerability in the mod_sftp module that allows authenticated low-privilege attackers to achieve arbitrary code execution by sending crafted SFTP packet fragments exceeding the 16 KB reassembly buffer in the fxp.c component. Attackers can supply oversized fragments to trigger an incorrectly conditioned reallocation, corrupt pool freelist metadata, overwrite the root_fs BSS global pointer to reference a fake filesystem struct, and redirect pr_fsio_stat() to system() via a crafted RENAME request.
Vulnerability class: Buffer Overflow
EPSS: 0.009 (58.2th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Proftpd — versions 1.3.10rc1, 0, 1.3.10
Weakness classification (CWE)
References
- disclosure@vulncheck.com (release-notes, Release Notes)
- disclosure@vulncheck.com (release-notes, Product, Release Notes, patch)
- disclosure@vulncheck.com (release-notes, Product, Release Notes, patch)
- disclosure@vulncheck.com (issue-tracking, Issue Tracking)
- disclosure@vulncheck.com (Patch, patch)
- disclosure@vulncheck.com (Patch, Third Party Advisory, Release Notes, third-party-advisory)
Frequently asked questions
- What is CVE-2026-63090?
- CVE-2026-63090 is a high-severity vulnerability in Proftpd, classified under Heap-based Buffer Overflow. CVSS score: 8.8/10. Published 2026-07-20.
- How severe is CVE-2026-63090?
- High severity. CVSS v3 base score is 8.8 out of 10.