High severity · published Jul 20, 2026
CVE-2026-63090
ProFTPD mod_sftp Heap Buffer Overflow via SFTP Packet Reassembly
8.8
CVSS
0.9%
EPSS
No
On KEV
Description
ProFTPD before 1.3.9c and 1.3.10rc3 contains a heap-based buffer overflow vulnerability in the mod_sftp module that allows authenticated low-privilege attackers to achieve arbitrary code execution by sending crafted SFTP packet fragments exceeding the 16 KB reassembly buffer in the fxp.c component. Attackers can supply oversized fragments to trigger an incorrectly conditioned reallocation, corrupt pool freelist metadata, overwrite the root_fs BSS global pointer to reference a fake filesystem struct, and redirect pr_fsio_stat() to system() via a crafted RENAME request.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 60% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PR
proftpd · proftpd
before 1.3.9c; 1.3.10rc1 before 1.3.10rc3 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-63090
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-63090
Release Notes
https://github.com/proftpd/proftpd/blob/master/RELEASE_NOTES
Patch
https://github.com/proftpd/proftpd/commit/4ee8701bcf425f11b3b2116e634ff3e655d918b1
Issue Tracking
https://github.com/proftpd/proftpd/issues/2190
Product
https://github.com/proftpd/proftpd/releases/tag/v1.3.10rc3-3
Product
https://github.com/proftpd/proftpd/releases/tag/v1.3.9c
Third Party Advisory
https://www.vulncheck.com/advisories/proftpd-mod-sftp-heap-buffer-overflow-via-sftp-packet-reassembly
More from proftpd
10.0
CVE-2015-3306
ProFTPD Improper Access Control Vulnerability
9.8
CVE-2010-20103
A malicious backdoor was embedded in the official ProFTPD 1.3.3c source tarball distributed between November 28 and December 2, 2010
9.8
CVE-2019-12815
An arbitrary file copy vulnerability in mod_copy in ProFTPD up to 1.3.5b allows for remote code execution and information disclosure without authentication, a related issue to…
8.8
CVE-2020-9273
In ProFTPD 1.3.7, it is possible to corrupt the memory pool by interrupting the data transfer channel
8.1
CVE-2026-35025
ProFTPD ACL Bypass via /proc/self/root Path Prefix in RNFR