Proftpd dfsg: ProFTPD before 1.3.9c and 1.3.10rc3 contains a heap-based buffer overflow vulnerability in the mod_sftp module that allows authenticated… (CVE-2026-63090)

CVE-2026-63090 is a heap-based buffer overflow vulnerability in the mod_sftp module of ProFTPD versions prior to 1.3.9c and 1.3.10rc3. Authenticated attackers with low privileges can exploit this flaw by sending specially crafted SFTP packet fragments that exceed the 16 KB reassembly buffer, leading to memory corruption. This corruption enables attackers to redirect function calls and execute arbitrary system commands, potentially compromising the affected system. The vulnerability is identified as CWE-122 (Heap-based Buffer Overflow).

Successful exploitation allows authenticated low-privilege attackers to execute arbitrary code with the privileges of the ProFTPD process, leading to full compromise of the affected system. The vulnerability impacts confidentiality, integrity, and availability, as indicated by the CVSS vector (C:H/I:H/A:H).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the ProFTPD service to trusted users only and monitor for unusual activity related to SFTP connections.