ProFTPD before 1.3.9c and 1.3.10rc3 contains a heap-based buffer overflow vulnerability in the mod_sftp module that allows authenticated low-privilege attackers to achieve arbitrary code execution by sending crafted SFTP packet fragments exceeding the 16 KB reassembly buffer in the fxp.c component. Attackers can supply oversized fragments to trigger an incorrectly conditioned reallocation, corrupt pool freelist metadata, overwrite the root_fs BSS global pointer to reference a fake filesystem struct, and redirect pr_fsio_stat() to system() via a crafted RENAME request.
References
| Link | Resource |
|---|---|
| https://github.com/proftpd/proftpd/blob/master/RELEASE_NOTES | Release Notes |
| https://github.com/proftpd/proftpd/commit/4ee8701bcf425f11b3b2116e634ff3e655d918b1 | Patch |
| https://github.com/proftpd/proftpd/issues/2190 | Issue Tracking |
| https://github.com/proftpd/proftpd/releases/tag/v1.3.10rc3-3 | Product Release Notes |
| https://github.com/proftpd/proftpd/releases/tag/v1.3.9c | Product Release Notes |
| https://www.vulncheck.com/advisories/proftpd-mod-sftp-heap-buffer-overflow-via-sftp-packet-reassembly | Third Party Advisory Patch Release Notes |
Configurations
Configuration 1 (hide)
|
History
30 Jul 2026, 17:19
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/proftpd/proftpd/blob/master/RELEASE_NOTES - Release Notes | |
| References | () https://github.com/proftpd/proftpd/commit/4ee8701bcf425f11b3b2116e634ff3e655d918b1 - Patch | |
| References | () https://github.com/proftpd/proftpd/issues/2190 - Issue Tracking | |
| References | () https://github.com/proftpd/proftpd/releases/tag/v1.3.10rc3-3 - Product, Release Notes | |
| References | () https://github.com/proftpd/proftpd/releases/tag/v1.3.9c - Product, Release Notes | |
| References | () https://www.vulncheck.com/advisories/proftpd-mod-sftp-heap-buffer-overflow-via-sftp-packet-reassembly - Third Party Advisory, Patch, Release Notes | |
| CPE | cpe:2.3:a:proftpd:proftpd:1.3.10:rc1:*:*:*:*:*:* cpe:2.3:a:proftpd:proftpd:1.3.10:rc2:*:*:*:*:*:* cpe:2.3:a:proftpd:proftpd:*:*:*:*:*:*:*:* |
|
| First Time |
Proftpd
Proftpd proftpd |
20 Jul 2026, 15:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-07-20 15:16
Updated : 2026-07-30 17:19
NVD link : CVE-2026-63090
Mitre link : CVE-2026-63090
CVE.ORG link : CVE-2026-63090
JSON object : View
Products Affected
proftpd
- proftpd
CWE
CWE-122
Heap-based Buffer Overflow