LightFTP in versions up to 2.4 contains a data race bug in ftpserv.c. An attacker who can issue FTP commands without authenticating can send a LIST command followed by an ABOR command. The control thread closes the data socket and file descriptor while a worker thread is still using those descriptors. Because the operating system may allocate the same descriptors to a different file or socket, the worker thread can subsequently operate on an unrelated resource, producing undefined behavior that can crash the service or otherwise disrupt availability. This flaw is described by CWE‑820. The primary impact is the potential for a denial of service attack allowing an unauthenticated remote victim to cause the FTP server to become non‑responsive.

The vulnerability affects the hfiref0x LightFTP product, specifically all releases through version 2.4. The affected code resides in ftpserv.c and the race occurs between the control thread and worker threads. Users running LightFTP 2.4 or earlier are at risk unless they apply a fix, if one is provided by the vendor.

The vulnerability receives a high CVSS score of 8.2, indicating significant severity. No EPSS score is publicly available, but the flaw is not currently listed in CISA’s KEV catalog. An attacker needs only to establish an unauthenticated FTP session, which is possible by default when anonymous login is enabled. The attack vector is likely network‑based remote exploitation via the FTP control connection. Because the flaw does not require privilege escalation or a prior compromise, it is accessible to any external user who can reach the FTP service. While no public exploits have been reported, the clear, straightforward race condition makes it a viable candidate for exploitation with minimal effort.