Xlight FTP Server < 3.9.5 Pre-Auth Heap Buffer Overflow via SSH Parser

published 2026-07-29 3 mo ago modified 2026-10-23 16 d ago also EUVD-2026-50398

cvss: 9.8; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 1.0%; EPSS 1.0% chance of exploitation in 30 days, percentile 61%
public exploits: 0; none known

Xlight FTP Server before 3.9.5 contains a pre-authentication heap buffer overflow vulnerability that allows remote unauthenticated attackers to write past the end of a heap buffer by sending a malformed SSH client identification string. A logic error in the recv loop's termination condition uses an incorrect OR operator where an AND operator is required, enabling exploitation on any SSH or SFTP connection before authentication occurs.

Patch / fix

fixed in 1

Xlight Xlight FTP Server 3.9.5

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: total
Assessed: 3 mo ago (2026-07-29)

Exploit prediction

0.96% chance of exploitation in the next 30 days, higher than 61% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	4.0	9.3	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CNA	3.1	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA	4.0	9.3	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected products

Xlight Xlight FTP Server

Classification

Weakness

CWE-122 Heap-based Buffer Overflow

References

xlightftpd.com /whatsnew.htm
release-notes
vulncheck.com /advisories/xlight-ftp-server-pre-auth-heap-buffer-overflow-via-ssh-parser
third-party-advisory

Sources

CVE List CVE-2026-67191
NVD CVE-2026-67191

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary