A malformed SSH packet containing an unvalidated length field is passed directly to the GCM decrypt function in Xlight FTP Server versions prior to 3.9.5, leading to a stack buffer overflow. The overflow can overwrite the stack cookie and return address, enabling the attacker to execute arbitrary code before any user authentication takes place. This vulnerability is formally classified as CWE‑121, stack-based buffer overflow.

The defect affects all installations of Xlight FTP Server before version 3.9.5. No patch or version information is supplied beyond the recommendation to upgrade to 3.9.5 or later for remediation.

The CVSS score of 9.2 indicates a critical severity, yet the EPSS score of less than 1% suggests a low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Because authentication is not required, the likely attack vector is a remote connection to the FTP service where an attacker can send crafted SSH packets. Successful exploitation would give the attacker full control of the server.