This vulnerability involves a stack-based buffer overflow (CWE-121) in the WinaXe FTP Client 7.7, specifically within the WCMDPA10.dll module responsible for parsing FTP server banners. When the client receives an excessively long '220 Server Ready' response, it overflows a stack buffer, enabling an attacker to execute arbitrary code under the user's context. The vulnerability is remotely exploitable without privileges or user interaction, and it affects the client software directly. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability allows remote attackers to execute arbitrary code on the affected system with the privileges of the user running the WinaXe FTP Client. This can lead to full compromise of the user's environment, including data theft, system manipulation, or further malware deployment. Since the vulnerability is triggered by the FTP server's banner response, an attacker controlling or spoofing an FTP server could exploit this flaw. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should avoid connecting to untrusted or potentially malicious FTP servers. Monitoring vendor channels for updates is recommended. No official patch or workaround has been provided as of the publication date.