A stack buffer overflow has been identified in the banner parsing logic of WCMDPA10.dll in WinaXe FTP Client 7.7. When the client receives a 220 Server Ready message that exceeds the expected length, the overflow allows an attacker to overwrite the return pointer and inject arbitrary code. This flaw permits code execution with the privileges of the local user, potentially compromising confidentiality, integrity and availability of the system. The weakness aligns with CWE-121.

Laboratory of Fine Applications (LabF) WinaXe FTP Client, version 7.7. The vulnerability resides in the FTP banner processing module and applies to installations of this specific release that have not applied any corrective update.

The CVSS v3 score of 8.7 marks this issue as high severity, and the EPSS percentage of 57% indicates a high likelihood that the vulnerability is being actively exploited in the wild. The vulnerability is not yet listed in CISA KEV, but the combination of a remote trigger and the ability to execute code suggests that it can be leveraged by attackers from a remote FTP server. An attacker would need control over an FTP server to send a crafted 220 banner; no local privilege escalation is required beyond user context.