CVE-2026-67192
Xlight FTP Server versions before 3.9.5 contain a critical stack buffer overflow that can be triggered by unauthenticated attackers sending specially crafted SSH packets. The flaw allows attackers to overwrite stack memory and potentially execute arbitrary code before authentication. Upgrading to version 3.9.5 or later resolves the issue.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Xlight FTP Server, versions prior to 3.9.5.
Real-world impact
An attacker could take control of the FTP server, run arbitrary code, and compromise the host before any login.
Why this severity
The CVSS score of 9.2 reflects the high impact of remote code execution with no authentication or user interaction required, and the vulnerability allows attackers to overwrite critical stack data. Because the flaw can be exploited without credentials and without user interaction, it is considered critical.
What to do about it
- 01Upgrade Xlight FTP Server to version 3.9.5 or later.
- 02Restart the FTP service.
NVD description
Timeline
- Jul 29, 2026 · 20h agoPublishedDisclosed and added to the National Vulnerability Database.
- Jul 29, 2026 · 19h agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.