The flaw is a heap‑based buffer overflow in the mod_sftp module of ProFTPD, triggered when an authenticated SFTP client sends a packet whose length field is zero. The unsigned underflow allows the allocator to believe a four‑gigabyte block was requested, but only a 512‑byte buffer is allocated; writing the oversized packet body past this buffer overflows heap metadata, causing the per‑connection child process to crash and resulting in a remote denial of service. The overflow may also corrupt heap structures, potentially leading to further exploitation, but the proof of concept demonstrates only denial of service.

Any installation of ProFTPD that includes the mod_sftp module is affected. The specific product vendor is ProFTPD Project:ProFTPD, and no version range is provided, so all builds containing the vulnerable code may be impacted.

The CVSS score of 7.7 indicates a high severity, while the EPSS score of < 1 % suggests a very low likelihood of exploitation at present, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated SFTP session; an attacker with SFTP login credentials can craft a malicious packet with length zero and a body larger than 544 bytes to trigger the overflow remotely. Because the attack can be performed over the network by any authenticated user, the overall threat is moderate to high in environments where SFTP access is enabled, though the actual exploitation probability remains low.