Signed Integer Overflow in ProFTPD's SFTP Module Affects ProFTPD Versions

CVE-2026-63091

What is CVE-2026-63091?

ProFTPD versions prior to 1.3.9c and 1.3.10rc3 are susceptible to a signed integer overflow vulnerability in the SCP size-record parser of the mod_sftp module. This issue can be exploited by authenticated low-privilege users who can send a carefully crafted file size value of UINT64_MAX. The exploitation leads to a negative offset value, resulting in an excessive read length (approximately 4 GB). Consequently, the server may inadvertently read beyond the SSH channel data, overwriting process memory and allowing attackers to retrieve sensitive information, such as libc and libcrypto pointers, which can facilitate the bypass of Address Space Layout Randomization (ASLR) and enhance the likelihood of exploiting memory corruption vulnerabilities.

References