A buffer overflow exists in the PORT command handler of PCMan FTP Server versions up to 2.0.7, allowing an attacker to send a specially crafted command that overflows a buffer and potentially writes arbitrary data to memory. This kind of memory corruption can enable remote execution of attacker‑supplied code or other unintended behavior. The vulnerability is categorized under CWE‑119 and CWE‑120, both describing unsafe use of buffers.

PCMan FTP Server, versions up to and including 2.0.7. No specific environment or platform details are listed, but the issue exists in the FTP server component itself.

The base CVSS score of 6.9 indicates a medium risk of compromise. The EPSS score of <1% indicates a very low, but non‑zero, probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog, yet a public exploit is known and has been made available online. The attack vector is remote; an attacker only needs to send a malicious PORT command over the network to trigger the overflow, potentially gaining full code execution on the host running the server.