BulletProof FTP Server 2019.0.0.50 contains a flaw that permits a local attacker who can alter firewall settings to crash the service by entering an overly long string into the DNS Address field. When the Test function is triggered, the server processes a 700‑byte buffer and terminates unexpectedly, causing a service outage.

The vulnerability affects the BulletProof FTP Server product, version 2019.0.0.50. Systems that enable the DNS Address option in their firewall configuration are susceptible.

Medium severity is reflected in the assessment score of 6.9, while the estimated chance of exploitation is very low, below 1%. The flaw is not listed in the CISA Known Exploited Vulnerabilities catalog. Attackers require local access and appropriate privileges to modify firewall settings; no remote exploitation path is documented. Therefore, the overall risk is moderate in environments where local administrative functions are available but unlikely to be widely leveraged.