CVE-2026-67191 is a heap-based buffer overflow vulnerability in Xlight FTP Server before version 3.9.5. The issue stems from a logic error in the termination condition of the receive loop, where an incorrect OR operator is used instead of an AND operator. This flaw allows remote unauthenticated attackers to send a malformed SSH client identification string that causes a write past the end of a heap buffer. Exploitation is possible on any SSH or SFTP connection before authentication occurs, making it a pre-authentication vulnerability.

Successful exploitation of this vulnerability can lead to memory corruption due to heap buffer overflow, potentially allowing remote attackers to execute arbitrary code or cause a denial of service on the affected server. Given the pre-authentication nature, no credentials are required to exploit this flaw, increasing its severity and risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to restrict SSH/SFTP access to trusted networks or apply network-level controls to limit exposure. Monitor vendor channels for updates regarding patches or official mitigations.