The storage-path configuration setting in BulletProof FTP Server 2019.0.0.50 accepts an excessively long string that causes the application to crash when the configuration is saved. An attacker with local privilege can enable the Override Storage-Path option and paste a buffer of 500 bytes or more, resulting in a denial of service for the FTP service while the server remains stuck until it is restarted. The flaw is caused by insufficient input validation of the length of the path string and is classified as a buffer overflow style issue (CWE-1282).

BulletProof FTP Server version 2019.0.0.50, provided by Bpftpserver, is affected on Windows operating systems. This vulnerability does not exist in earlier or later releases of the product.

The CVSS score of 6.9 indicates moderate severity. Because the exploit requires local access and offers no way to execute arbitrary code, the risk is limited to a temporary service outage. The EPSS score of less than 1% reflects a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. This suggests that while the flaw is real, it is unlikely to be widely abused in the wild.