CVE-2026-63091
Received Received - Intake

Integer Overflow in ProFTPD SCP Parser Enables ASLR Bypass

Publication date: 2026-07-20

Last updated on: 2026-07-20

Assigner: VulnCheck

Description
ProFTPD before 1.3.9c and 1.3.10rc3 contains a signed integer overflow vulnerability in the mod_sftp module's SCP size-record parser that allows authenticated low-privilege attackers to bypass ASLR by sending a crafted file size value of UINT64_MAX, which results in a negative off_t value. Attackers can exploit the subsequent conversion to uint32_t, causing an approximately 4 GB requested read length and forcing the server to read beyond the end of the SSH channel data and write overread process memory into the uploaded file. In tested configurations, the disclosed data contains libc, libcrypto, and PIE pointers sufficient to derive their randomized base addresses, thereby bypassing ASLR and enabling reliable exploitation of memory corruption vulnerabilities in the same process.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-20
Last Modified
2026-07-20
Generated
2026-07-21
AI Q&A
2026-07-20
EPSS Evaluated
N/A
NVD
CVE-2026-63091
EUVD
EUVD-2026-45961

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
proftpd proftpd to 1.3.9c|start_including=1.3.10rc1|end_excluding=1.3.10rc3 (exc)
proftpd proftpd to 1.3.9c|end_excluding=1.3.10rc3 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-126 The product reads from a buffer using buffer access mechanisms such as indexes or pointers that reference memory locations after the targeted buffer.
CWE-190 The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-63091 is a signed integer overflow vulnerability in ProFTPD's mod_sftp module affecting SCP file transfers. It occurs when the server improperly handles client-provided file size values, allowing an attacker to send a crafted value of UINT64_MAX. This causes a negative off_t value, leading to a buffer over-read that writes overread process memory into the uploaded file. Attackers can bypass ASLR by leaking pointers to libc, libcrypto, and PIE, enabling further exploitation.

Detection Guidance

To detect this vulnerability, check the ProFTPD version running on your system. Vulnerable versions are before 1.3.9c and between 1.3.10rc1 and 1.3.10rc3. Use commands like 'proftpd -v' or 'rpm -qa | grep proftpd' to verify the installed version.

Impact Analysis

If you use ProFTPD versions before 1.3.9c or 1.3.10rc3, an authenticated attacker could exploit this to bypass ASLR and leak sensitive memory addresses. This could allow further attacks like memory corruption exploits, leading to potential data breaches, unauthorized access, or server compromise. The impact depends on server configuration and deployed defenses.

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration, violating GDPR's data protection requirements or HIPAA's safeguards for protected health information. Organizations using vulnerable ProFTPD versions may face compliance violations, legal penalties, or reputational damage if exploited.

Mitigation Strategies

Immediately upgrade ProFTPD to version 1.3.9c or 1.3.10rc3 or later. Disable SCP functionality if not required. Monitor network traffic for unusual file size values during SCP transfers.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63091. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart