A malformed packet that can be sent during the SFTP handshake causes a Go panic in Wings, terminating the process. The flaw arises from improper handling of packet lengths and boundary checks, leading to unchecked data and a panic that crashes the service. When triggered, Wings stops, denying control‑plane availability to administrators and any dependent services.

Servers running the Pterodactyl Wings control plane prior to version 1.13.0 are vulnerable. The fix was introduced in release 1.13.0, and all earlier releases, including 1.12.x and earlier, may crash when a malicious SFTP packet is received.

The CVSS score of 7.5 indicates a severe threat, but the EPSS score of less than 1% shows that exploitation is very unlikely. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker to initiate an SFTP session or otherwise deliver a crafted handshake packet to the Wings service; once triggered, the service will stop until manually restarted.