Heap-Based Buffer Overflow in ProFTPD's mod_sftp Module
CVE-2026-63090

8.7HIGH

Key Information:

Vendor

Proftpd

Status
Proftpd
Vendor
CVE Published:
20 July 2026

What is CVE-2026-63090?

The ProFTPD software prior to version 1.3.9c and 1.3.10rc3 is susceptible to a heap-based buffer overflow within the mod_sftp module. This vulnerability enables authenticated low-privilege attackers to execute arbitrary code by sending specially crafted SFTP packet fragments that exceed the 16 KB reassembly buffer limits in the fxp.c component. By manipulating oversized fragments, attackers can trigger an incorrect reallocation condition, potentially corrupting pool freelist metadata. This manipulation may allow them to overwrite the root_fs BSS global pointer. Consequently, a crafted RENAME request can reroute the execution flow to invoke system functions instead of the expected file system operations.

Affected Version(s)

proftpd 0

proftpd 0 < 1.3.9c

proftpd 1.3.10rc1 < 1.3.10rc3

References

https://github.com/proftpd/proftpd/blob/master/RELEASE_NOTES
release-notes
https://github.com/proftpd/proftpd/releases/tag/v1.3.10rc3-3
release-notes
https://github.com/proftpd/proftpd/releases/tag/v1.3.9c
release-notes

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Fabian Wahle with Hap Security
.