Core FTP Server version 2.0 build 653 is vulnerable when an unauthenticated client sends an oversized PBSZ command. The malformed command, which exceeds 211 bytes, triggers an access violation that crashes the FTP server process. The crash results in a denial of service and disrupts the availability of the FTP service for all users, but does not directly compromise data confidentiality or integrity.

The affected system is Core FTP Server version 2.0 build 653. No other versions or builds are mentioned as affected.

The CVSS score of 8.7 indicates a high severity vulnerability that can be exploited over the network without authentication. Although the EPSS score is not provided and the vulnerability is not listed in CISA’s KEV catalog, the nature of the flaw allows attackers to cause a service crash by simply sending a crafted PBSZ request. Once an attacker succeeds, the FTP service becomes unavailable until the server is restarted or restarted manually, making this a critical issue for services that rely on high availability.