CVE-2026-53994 is a heap-based buffer overflow in the ProFTPD mod_sftp module. The vulnerability arises because the fxp_packet_read() function accepts a 32-bit big-endian SFTP packet length without a minimum sanity check. When a packet length of zero is supplied, an unsigned subtraction underflows to approximately 4 GB. The core memory allocator then receives a size_t value representing ~4 GB but calls new_block() with a truncated 32-bit integer of zero, resulting in a small (~512-byte) allocation. The subsequent fill loop writes attacker-controlled data beyond the allocated buffer, causing a heap overflow. An authenticated user can reliably cause a denial of service by crashing the per-connection ProFTPD session child. While heap metadata corruption and further impacts are possible, only denial of service has been demonstrated by the proof of concept.

An authenticated SFTP user can remotely cause a denial of service by crashing the ProFTPD session process via a crafted SFTP packet. The heap overflow may also corrupt heap metadata, potentially leading to further undefined behavior or escalation, but no such exploitation has been demonstrated. The vulnerability affects confidentiality, integrity, and availability as indicated by the CVSS vector, but the demonstrated impact is denial of service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or workaround is currently documented. Until a patch is available, restrict authenticated SFTP user access to trusted users only and monitor for unusual crashes in ProFTPD session processes.