A buffer overflow exists in Core FTP/SFTP Server version 1.2 that is triggered when an attacker supplies an excessively long string in the User domain field. The overflow can happen when a malicious payload of about 7000 bytes is pasted into the domain configuration, causing the application to crash and the service to become unavailable. This flaw directly results in a denial‑of‑service condition for users of the server.

The vulnerability affects Core FTP/SFTP Server 1.2, the only affected software listed by the CNA. No other products or versions are mentioned as vulnerable.

The flaw carries a CVSS score of 8.7 and an EPSS score of less than 1%, indicating that while the vulnerability is severe, the probability that it is currently exploited is low. It is not present in the CISA Known Exploited Vulnerabilities catalog. The most likely attack vector is remote: an attacker can send the long string to the FTP/SFTP server over the network, inserting the payload into the domain configuration. If executed, the server will crash, denying service to legitimate users.