CVE-2026-63090highCWE-122

CVE-2026-63090: high-severity vulnerability in proftpd

ProFTPD mod_sftp Heap Buffer Overflow via SFTP Packet Reassembly

Published · Updated

Follow this CVE+ Monitor ProFTPD+ Monitor proftpd-dfsg

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.7epss 0.9%
ProFTPD before 1.3.9c and 1.3.10rc3 contains a heap-based buffer overflow vulnerability in the mod_sftp module that allows authenticated low-privilege attackers to achieve arbitrary code execution by sending crafted SFTP packet fragments exceeding the 16 KB reassembly buffer in the fxp.c component. Attackers can supply oversized fragments to trigger an incorrectly conditioned reallocation, corrupt pool freelist metadata, overwrite the root_fs BSS global pointer to reference a fake filesystem struct, and redirect pr_fsio_stat() to system() via a crafted RENAME request.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
proftpd · proftpd
Related CVEs — proftpd

In the same product, most dangerous first.

CVE-2026-63091HIGHProFTPD mod_sftp Signed Integer Overflow via SCP Size-Record ParserEPSS 0.5%