CVE-2026-67607 is a TOCTOU race condition vulnerability in LightFTP up to version 2.3.1. It exists in the worker_thread_cleanup() function of ftpserv.c, where unsynchronized access to shared per-connection state occurs without the necessary mutex lock. The vulnerability is a residual issue from an incomplete fix for CVE-2024-11144; the patch in 2.3.1 only narrowed the timing window but did not add the missing lock. Exploitation involves sending a LIST command followed immediately by ABOR, causing detached thread ID reuse and unsynchronized cleanup, which destabilizes or crashes the daemon, resulting in denial of service.

Successful exploitation allows remote unauthenticated attackers to destabilize or crash the LightFTP daemon, causing denial of service. There is no indication of code execution or data disclosure. The impact is limited to service availability disruption.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The existing 2.3.1 patch does not fully fix the issue as it lacks the required mutex lock. Until an official fix is released, users should consider mitigating exposure by restricting access to the FTP service or applying any vendor-recommended workarounds once available.