CVE-2026-63090 Details
Description
ProFTPD before 1.3.9c and 1.3.10rc3 contains a heap-based buffer overflow vulnerability in the mod_sftp module that allows authenticated low-privilege attackers to achieve arbitrary code execution by sending crafted SFTP packet fragments exceeding the 16 KB reassembly buffer in the fxp.c component. Attackers can supply oversized fragments to trigger an incorrectly conditioned reallocation, corrupt pool freelist metadata, overwrite the root_fs BSS global pointer to reference a fake filesystem struct, and redirect pr_fsio_stat() to system() via a crafted RENAME request.
A heap-based buffer overflow vulnerability has been identified in the ProFTPD FTP server software, specifically in versions prior to 1.3.9c and between 1.3.10rc1 and 1.3.10rc3. This vulnerability resides within the mod_sftp module and allows authenticated low-privilege attackers to execute arbitrary code. The issue arises when crafted SFTP packet fragments exceeding 16 KB are sent, exploiting an improperly managed reallocation process. This leads to corruption of the memory pool's metadata, overwriting critical pointers to redirect function calls to system commands, effectively allowing code execution.
Users can upgrade to ProFTPD versions 1.3.9c or 1.3.10rc3 and later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 21, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/proftpd/proftpd/blob/master/RELEASE_NOTES | [email protected] | Release Notes |
| https://github.com/proftpd/proftpd/commit/4ee8701bcf425f11b3b2116e634ff3e655d918b1 | [email protected] | Patch |
| https://github.com/proftpd/proftpd/issues/2190 | [email protected] | Issue Tracking |
| https://github.com/proftpd/proftpd/releases/tag/v1.3.10rc3-3 | [email protected] | ProductRelease Notes |
| https://github.com/proftpd/proftpd/releases/tag/v1.3.9c | [email protected] | ProductRelease Notes |
| https://www.vulncheck.com/advisories/proftpd-mod-sftp-heap-buffer-overflow-via-sftp-packet-reassembly | [email protected] | Third Party AdvisoryPatchRelease Notes |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-122 | Heap-based Buffer Overflow | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| proftpd proftpd | < 1.3.9c 1.3.10 rc1 1.3.10 rc2 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 30, 2026 | Initial Analysis | [email protected] |
| Jul 21, 2026 | CVE Modified | CISA-ADP |
| Jul 20, 2026 | New CVE Received | [email protected] |