The Xlight FTP Server 3.9.1 contains a structured exception handler overwrite due to a buffer overflow in the program execution field of the virtual server configuration. An attacker with local access can craft a 428‑byte payload that corrupts the SEH chain, potentially allowing arbitrary code execution within the FTP server process. The weakness corresponds to an out‑of‑bounds write (CWE‑787).

This vulnerability affects Xlight FTP Server version 3.9.1, distributed by Xlightftpd. No other versions are indicated as vulnerable.

The CVSS score of 8.6 denotes high severity; however, the EPSS score is below 1%, implying a low likelihood of widespread exploitation. The vulnerability is not listed in the CISA KEV catalog. It requires local access and the ability to edit virtual server configuration files, so the threat is primarily local. Successful exploitation would grant the attacker control over the server process.