CVE-2026-67192

Deferred Deferred - Pending Action

Pre-authentication Stack Buffer Overflow in Xlight FTP Server

Publication date: 2026-07-29

Last updated on: 2026-07-29

Assigner: VulnCheck

Description

Xlight FTP Server before 3.9.5 contains a pre-authentication stack buffer overflow vulnerability that allows unauthenticated attackers to corrupt stack memory by sending malformed SSH packets when a GCM cipher is negotiated. Attackers can craft packets with an unvalidated length field passed directly to the GCM decrypt function, overwriting the stack cookie and return address to potentially achieve remote code execution before any authentication occurs.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-29

Last Modified

2026-07-29

Generated

2026-08-19

AI Q&A

2026-07-30

EPSS Evaluated

2026-08-18

NVD

CVE-2026-67192

Affected Vendors & Products

Vendor	Product	Version / Range
xlight	ftp_server	to 3.9.5 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-121	A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).

Attack-Flow Graph

Executive Summary

Xlight FTP Server before version 3.9.5 has a pre-authentication stack buffer overflow flaw. Unauthenticated attackers can exploit this by sending malformed SSH packets during GCM cipher negotiation. The vulnerability occurs because an unvalidated length field in these packets is passed directly to the GCM decrypt function, corrupting stack memory including the stack cookie and return address. This could allow attackers to overwrite critical memory and potentially execute arbitrary code before any authentication is required.

Detection Guidance

Detecting this vulnerability requires monitoring for malformed SSH packets with unvalidated length fields during GCM cipher negotiation. Use network traffic analysis tools like Wireshark to inspect SSH handshake packets for abnormal packet lengths or corrupted fields. Check Xlight FTP Server logs for crashes or stack corruption errors during cipher negotiation.

Impact Analysis

This vulnerability allows remote attackers to execute arbitrary code on the affected server without authentication. If exploited, it could lead to full system compromise, data theft, unauthorized access to sensitive files, or the server being used as a pivot point for further attacks within the network. Systems running vulnerable versions of Xlight FTP Server are at direct risk.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. If exploited, it may result in data breaches that require regulatory reporting and potential fines. Organizations using vulnerable FTP servers may fail to meet security and access control standards mandated by these regulations.

Mitigation Strategies

Immediately update Xlight FTP Server to version 3.9.5 or later to patch the stack buffer overflow. Disable SSH access if not required or restrict cipher suites to exclude GCM modes. Implement network-level protections like firewalls to block malformed SSH packets targeting the FTP server.

Hi! I’m here to help you understand CVE-2026-67192. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70