CVE-2026-67191

A heap buffer overflow in Xlight FTP Server allows attackers to write data past the end of a heap buffer by sending a malformed SSH client identification string before authentication. The flaw stems from a logic error in the receive loop’s termination condition that uses an incorrect OR operator instead of AND. The vulnerability permits unauthenticated remote attackers to perform an out‑of‑bounds write on the server, which can compromise the integrity or availability of the service. While the description does not document specific remote code execution or denial of service, the high CVSS score indicates that severe impact is possible if the overflow is successfully exploited. Affected systems are all instances of Xlight FTP Server running a version prior to 3.9.5. The vulnerability is exploitable over SSH or SFTP connections before the user is authenticated. The CVSS score of 9.3 reflects the high impact, while the EPSS score of <1% indicates a low current exploitation probability. The vulnerability is not listed in CISA’s KEV catalog, but the remote nature and severity merit immediate attention.

All instances of Xlight FTP Server running a version before 3.9.5 are affected.

The CVSS score of 9.3 reflects the high impact, while the EPSS score of <1% indicates a low current exploitation probability. The vulnerability is not listed in CISA’s KEV catalog, but the remote nature and severity warrant immediate attention.