A signed integer overflow occurs in the SCP size‑record parser of ProFTPD’s mod_sftp module. When an authenticated low‑privilege SFTP client supplies a file size of UINT64_MAX, the server’s off_t becomes negative and is subsequently cast to a 32‑bit unsigned value. This produces an over‑large read length of roughly 4 GB, causing the server to read past the end of the SSH channel data and overwrite process memory into the uploaded file. The overread exposes libc, libcrypto, and PIE pointers, allowing the attacker to bypass ASLR and position further code execution. The issue is a classic type‑confusion integer overflow (CWE‑126) compounded by unchecked type conversion (CWE‑190), resulting in a critical memory corruption flaw that can be reused to compromise the entire server process. While no publicly available exploitation code exists yet, the CVSS score of 7.1 indicates a moderate‑to‑high risk. The EPSS score is less than 1 %, suggesting a low current likelihood of exploitation, but the requirement for an authenticated SFTP session expands the attack surface. The vulnerability is not listed in the CISA KEV catalog, yet the ability to subvert ASLR makes it a valuable stepping stone for future exploits.

ProFTPD installations running the mod_sftp module are vulnerable when using a version earlier than 1.3.9c or earlier than 1.3.10rc3. The affected builds include all releases prior to the patched 1.3.9c and 1.3.10rc3-3 tags.

The CVSS score of 7.1 reflects a serious impact with remote code execution potential. The EPSS score of less than 1 % indicates a low probability of current exploitation but does not eliminate risk. Because the flaw requires an authenticated low‑privilege SFTP session, the attacker must obtain legitimate credentials, but once in, the ASLR bypass dramatically increases the effectiveness of any additional memory‑corruption exploits in the same process. The vulnerability is not presently in the CISA KEV catalog, but its presence on widely deployed FTP servers makes it a high‑value target for attackers.