CuteFTP 5.0 XP contains a buffer overflow vulnerability in the Site Manager label field that allows an attacker to inject a payload larger than 520 bytes, overwrite the return address, and execute shellcode when a shortcut is created and launched. The flaw can lead to arbitrary code execution on the local system, compromising confidentiality, integrity, and availability of the affected machine.

The vulnerability affects the CuteFTP product 5.0 XP from globalscape. No other versions or products are mentioned in the data.

The CVSS score of 8.6 indicates a high impact severity. The EPSS score is not available and the vulnerability is not listed in KEV, suggesting it may not yet be actively exploited in the wild, but a local attacker with sufficient privileges can exploit it. The attack vector is local, requiring the attacker to run or preview a malicious shortcut within the affected application.