CVE-2026-63090

HighCVSS 8.8/10Last modified Jul 30, 2026

Description

ProFTPD before 1.3.9c and 1.3.10rc3 contains a heap-based buffer overflow vulnerability in the mod_sftp module that allows authenticated low-privilege attackers to achieve arbitrary code execution by sending crafted SFTP packet fragments exceeding the 16 KB reassembly buffer in the fxp.c component. Attackers can supply oversized fragments to trigger an incorrectly conditioned reallocation, corrupt pool freelist metadata, overwrite the root_fs BSS global pointer to reference a fake filesystem struct, and redirect pr_fsio_stat() to system() via a crafted RENAME request.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-122

Affected software

Vendor	Product	Versions
proftpd	proftpd	< 1.3.9c; >= 1.3.10rc1, < 1.3.10rc3

References

https://github.com/proftpd/proftpd/blob/master/RELEASE_NOTESRelease Notes
https://github.com/proftpd/proftpd/commit/4ee8701bcf425f11b3b2116e634ff3e655d918b1Patch
https://github.com/proftpd/proftpd/issues/2190Issue Tracking
https://github.com/proftpd/proftpd/releases/tag/v1.3.10rc3-3Product, Release Notes
https://github.com/proftpd/proftpd/releases/tag/v1.3.9cProduct, Release Notes
https://www.vulncheck.com/advisories/proftpd-mod-sftp-heap-buffer-overflow-via-sftp-packet-reassemblyThird Party Advisory, Patch, Release Notes

Timeline

Published: Jul 20, 2026
Last modified: Jul 30, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-630916.5ProFTPD before 1.3.9c and 1.3.10rc3 contains a signed integer overflow vulnerability in the mod_sftp module's SCP size-record parser that al CVE-2026-630924.3kirby-modules through 5.5.7, fixed in commit 315417e, contains an information disclosure vulnerability that allows any authenticated Kirby P CVE-2026-630938.8Cursor for Windows version 3.2.16 contains a binary planting vulnerability that allows remote attackers to achieve arbitrary code execution CVE-2026-630948.1SigNoz before 0.134.0 contains an open redirect vulnerability in the SSO authentication flow that allows unauthenticated attackers to steal CVE-2026-630956.5Dendrite through 0.13.8 contains an improper authorization vulnerability in the Matrix Client-Server API that allows any authenticated local CVE-2026-630965.8Dendrite through 0.13.8 contains a server-side request forgery vulnerability that allows unauthenticated attackers to cause the server to op CVE-2026-630974.3Dendrite through 0.13.8 contains an improper access control vulnerability in the syncapi /context endpoint (syncapi/routing/context.go) that CVE-2026-630985.3TheHive through 4.1.24 contains an unauthenticated information disclosure vulnerability that allows unauthenticated attackers to retrieve se CVE-2026-630996.5TheHive through 4.1.24 contains a broken object-level authorization vulnerability in the attachment download endpoints that allows any authe CVE-2026-63108.3Use after free in Dawn in Google Chrome prior to 147.0.7727.101 allowed a remote attacker who had compromised the renderer process to potent CVE-2026-631006.5Maybe through 0.6.0 contains a missing authorization vulnerability that allows authenticated low-privilege member-role users to access and m CVE-2026-631017.5Open Event Server through 1.19.1 contains a missing authentication vulnerability that allows unauthenticated attackers to export the complet