Log in Start free

Vulnerability · Published Jul 20, 2026 · Assigned by VulnCheck

CVE-2026-63090ProFTPD mod_sftp Heap Buffer Overflow via SFTP Packet Reassembly

High 8.8

In plain English

A high-severity heap buffer overflow in proftpd from proftpd. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 61% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.8High
Exploit odds (30 days)0.9%top 39.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

ProFTPD before 1.3.9c and 1.3.10rc3 contains a heap-based buffer overflow vulnerability in the mod_sftp module that allows authenticated low-privilege attackers to achieve arbitrary code execution by sending crafted SFTP packet fragments exceeding the 16 KB reassembly buffer in the fxp.c component. Attackers can supply oversized fragments to trigger an incorrectly conditioned reallocation, corrupt pool freelist metadata, overwrite the root_fs BSS global pointer to reference a fake filesystem struct, and redirect pr_fsio_stat() to system() via a crafted RENAME request.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12proftpd-dfsgno fix listedDEBIAN-CVE-2026-63090
Debian:13proftpd-dfsg1.3.8.c+dfsg-4+deb13u3DEBIAN-CVE-2026-63090
Debian:14proftpd-dfsg1.3.9c~dfsg-1DEBIAN-CVE-2026-63090
Ubuntu:22.04:LTSproftpd-dfsgno fix listedUBUNTU-CVE-2026-63090
Ubuntu:24.04:LTSproftpd-dfsgno fix listedUBUNTU-CVE-2026-63090
Ubuntu:26.04:LTSproftpd-dfsgno fix listedUBUNTU-CVE-2026-63090
Ubuntu:26.10proftpd-dfsgno fix listedUBUNTU-CVE-2026-63090

Affected products (as reported)

VendorProductVersions
proftpd proftpd 0 – before 1.3.9c1.3.10rc1 – before 1.3.10rc3

Weakness: CWE-122 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References