CVE-2026-67192 is a stack-based buffer overflow vulnerability in Xlight FTP Server prior to version 3.9.5. The vulnerability arises from improper validation of a length field in malformed SSH packets during GCM cipher negotiation. This length field is passed directly to the GCM decrypt function without validation, enabling attackers to corrupt stack memory, overwrite the stack cookie and return address, and potentially execute arbitrary code remotely without authentication.

An unauthenticated attacker can exploit this vulnerability to achieve remote code execution on the affected server before authentication. This compromises the confidentiality, integrity, and availability of the system running the vulnerable Xlight FTP Server version. The CVSS 4.0 base score is 9.2, indicating a critical severity with network attack vector, low attack complexity, no privileges required, no user interaction, and high impacts on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the Xlight FTP Server and monitor for suspicious SSH traffic patterns. Avoid exposing the service to untrusted networks.