The vulnerability exists in the fxp_packet_read() function of ProFTPD's mod_sftp. It accepts a 32-bit big-endian SFTP packet length without minimum sanity checks. When the length is zero, an unsigned subtraction underflows to approximately 4 GB. The core memory allocator rounds this size but passes it as a 32-bit int to new_block(), which returns a small buffer (~512 bytes) instead of the expected large allocation. The subsequent fill loop writes attacker-controlled data beyond the allocated buffer, causing a heap-based buffer overflow. This can be exploited by an authenticated SFTP user to crash the server process, resulting in a remote denial of service. The vulnerability has a CVSS 3.1 base score of 7.5, indicating high severity.

An authenticated SFTP user can cause a remote denial of service by sending a specially crafted packet that triggers a heap buffer overflow and crashes the ProFTPD session child process. Although denial of service is the demonstrated impact, the heap corruption could potentially be leveraged for further exploitation, but no such exploits are currently known or demonstrated.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or workaround information is provided at this time. Until a patch is available, restrict authenticated SFTP user privileges and monitor for unusual crashes in ProFTPD sessions.