CVE-2026-67191
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk44th percentile - higher than 44% of all known CVEs
Summary
Xlight FTP Server before version 3.9.5 has a pre-authentication heap buffer overflow vulnerability. A remote unauthenticated attacker can send a malformed SSH client identification string to write past the end of a heap buffer. A logic error in the recv loop enables exploitation before authentication.
Risk Assessment
An attacker can crash the server or potentially execute arbitrary code, leading to full compromise of the FTP server.
Recommendation
Update Xlight FTP Server to version 3.9.5 or later, which includes the fix.
Original NVD description (English source)
Xlight FTP Server before 3.9.5 contains a pre-authentication heap buffer overflow vulnerability that allows remote unauthenticated attackers to write past the end of a heap buffer by sending a malformed SSH client identification string. A logic error in the recv loop's termination condition uses an incorrect OR operator where an AND operator is required, enabling exploitation on any SSH or SFTP connection before authentication occurs.