SmartFTP Client version 9.0.2615.0 contains a denial‑of‑service vulnerability that allows local users to crash the application by entering an excessively long string in the Host field. This buffer‑under‑validation flaw triggers an application crash when a Host value of 300 repeated characters is supplied, leading to an interruption of services for users relying on the client. The weakness is categorized as CWE‑466, reflecting inadequate input validation. There is no evidence of broader compromise such as code execution or data theft.

The vulnerability affects SmartFTP Client version 9.0.2615.0 from the vendor Smartftp. No other versions are noted in the provided data.

The CVSS score of 6.9 indicates medium severity, while the EPSS score of less than 1% suggests a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, further reducing the likelihood of active exploitation. The attack vector inferred from the description is local, requiring an attacker to have access to the system on which SmartFTP is running. Exploitation causes a client crash but does not elevate privileges or expose sensitive data, limiting the impact primarily to service availability on the affected host.