The vulnerability resides in the SMTP configuration interface of BulletProof FTP Server version 2019.0.0.50. An oversized input can trigger a crash when the Test button is used, resulting in a denial of service. The weakness, classified as CWE‑1282, allows an attacker to supply a buffer of 257 'A' characters to cause the application to crash.

BulletProof FTP Server 2019.0.0.50, produced by Bpftpserver. The issue is present only in that specific release; users should verify whether newer or older versions are impacted.

The CVSS score of 6.8 indicates moderate severity. No EPSS score is available, so the likelihood of exploitation is uncertain. Based on the description, the attack vector is local – an attacker with access to the SMTP configuration interface can trigger the crash. The KEV database shows no listed exploitation of this flaw. While the vulnerability does not enable remote code execution, it provides an attacker local privilege to interrupt service availability, which can be disruptive in shared environments.