The vulnerability in Progress Software WS_FTP Server allows an unauthenticated remote attacker to exhaust memory by manipulating the XFT service message‑size and array‑size limits. When the limits are exceeded, the server spends excessive memory handling these requests, eventually becoming unresponsive and causing a denial of service. The weakness is classified as CWE‑770, meaning the software lacks proper resource management.

Versions of WS_FTP Server for Windows released before 2025.0.5 are affected. No other operating systems or product versions are specified as vulnerable in the provided data.

The CVSS score of 7.5 indicates a high severity vulnerability that can be exploited remotely without authentication. EPSS information is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting that large‑scale exploitation is not confirmed. Nonetheless, an attacker who can reach the server can trigger the denial of service by sending requests that exercise the increased memory limits. Until the issue is mitigated—either by applying the recommended limits or by upgrading—the risk remains significant.