A buffer overflow exists in the mod_rewrite int:utf8trans RewriteMap of ProFTPD versions prior to 1.3.9e and 1.3.10rc5. It permits attackers to send FTP command arguments exceeding 1024 bytes, thereby overflowing static buffers and corrupting session memory. The flaw can be triggered without authentication if pre‑login commands are rewritten, leading to abrupt crashes of the FTP session. This vulnerability is a classic CWE‑120 weakness: buffer copy without proper bounds checking.

The affected product is the ProFTPD server, specifically versions before 1.3.9e and before 1.3.10rc5. All installations running these versions are susceptible to the mentioned buffer overflow via the mod_rewrite utf8trans RewriteMap.

The CVSS score of 6.3 classifies this as medium severity. Exploitation is possible remotely over the network, and attackers can achieve memory corruption that leads to denial of service by crashing the FTP service. The EPSS is not available, and the vulnerability is not listed in CISA KEV, suggesting no widespread public exploitation yet. However, the lack of authentication requirement for pre‑login commands lowers the attack bar, meaning an attacker with network access can attempt exploitation immediately. The risk remains moderate but should be mitigated promptly.