CVE-2026-63090
Received Received - Intake

Heap-based Buffer Overflow in ProFTPD mod_sftp Module

Publication date: 2026-07-20

Last updated on: 2026-07-20

Assigner: VulnCheck

Description
ProFTPD before 1.3.9c and 1.3.10rc3 contains a heap-based buffer overflow vulnerability in the mod_sftp module that allows authenticated low-privilege attackers to achieve arbitrary code execution by sending crafted SFTP packet fragments exceeding the 16 KB reassembly buffer in the fxp.c component. Attackers can supply oversized fragments to trigger an incorrectly conditioned reallocation, corrupt pool freelist metadata, overwrite the root_fs BSS global pointer to reference a fake filesystem struct, and redirect pr_fsio_stat() to system() via a crafted RENAME request.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-20
Last Modified
2026-07-20
Generated
2026-07-21
AI Q&A
2026-07-20
EPSS Evaluated
N/A
NVD
CVE-2026-63090
EUVD
EUVD-2026-45960

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
proftpd proftpd From 1.3.10rc1 (inc) to 1.3.10rc3 (exc)
proftpd proftpd to 1.3.9c|end_excluding=1.3.10rc3 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-122 A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-63090 is a heap-based buffer overflow in ProFTPD's mod_sftp module affecting versions before 1.3.9c and between 1.3.10rc1 and 1.3.10rc3. Authenticated low-privilege attackers can exploit it by sending oversized SFTP packet fragments that exceed a 16 KB reassembly buffer in fxp.c. This triggers incorrect memory reallocation, corrupts pool freelist metadata, and allows overwriting the root_fs BSS global pointer to redirect pr_fsio_stat() to system() via a crafted RENAME request, enabling arbitrary code execution.

Detection Guidance

Detecting this vulnerability requires monitoring for unusual SFTP traffic patterns or buffer overflow attempts. Check ProFTPD logs for mod_sftp errors or crashes. Use network monitoring tools like tcpdump or Wireshark to inspect SFTP packet sizes and reassembly attempts. Look for fragmented packets exceeding 16 KB or malformed RENAME requests targeting the fxp.c component.

Impact Analysis

This vulnerability allows authenticated attackers with low privileges to execute arbitrary code on the ProFTPD server. This could lead to full system compromise, unauthorized data access, or denial-of-service conditions. Servers using vulnerable versions of ProFTPD with mod_sftp enabled are at risk if exposed to the internet or internal networks.

Compliance Impact

This vulnerability could lead to unauthorized code execution on systems handling sensitive data, potentially violating GDPR and HIPAA compliance by exposing personal or health information. Unauthorized access risks data breaches, which are prohibited under these regulations.

Mitigation Strategies

Upgrade ProFTPD to version 1.3.9c or 1.3.10rc3 or later immediately. Disable the mod_sftp module if SFTP is not required. Restrict authenticated user access to SFTP sessions. Monitor for exploit attempts and block suspicious IPs. Apply the patch from commit 4ee8701bcf425f11b3b2116e634ff3e655d918b1 if upgrading is not immediately possible.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63090. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart