Proftpd dfsg: ProFTPD before 1.3.9c and 1.3.10rc3 contains a signed integer overflow vulnerability in the mod_sftp module's SCP size-record parser that allows… (CVE-2026-63091)

CVE-2026-63091 affects ProFTPD versions prior to 1.3.9c and 1.3.10rc3 in the mod_sftp module's SCP size-record parser. An authenticated attacker with low privileges can exploit a signed integer overflow by sending a specially crafted file size value. This causes a negative off_t value leading to incorrect memory handling, allowing the server to read beyond the SSH channel data and overwrite process memory into the uploaded file. The leaked memory includes pointers that disclose ASLR randomized base addresses, facilitating reliable exploitation of other memory corruption vulnerabilities in the same process.

The vulnerability enables authenticated low-privilege attackers to bypass Address Space Layout Randomization (ASLR) by leaking memory pointers through crafted file uploads. This disclosure of memory layout information can assist attackers in reliably exploiting other memory corruption vulnerabilities in the ProFTPD process. The CVSS score of 6.5 (medium severity) reflects the confidentiality impact without direct integrity or availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, restrict access to the mod_sftp module to trusted users and monitor for suspicious authenticated activity involving SCP file uploads.