The vulnerability in ProFTPD's mod_sftp module arises from a signed integer overflow in the SCP size-record parser. When an attacker sends a crafted file size value of UINT64_MAX, it results in a negative off_t value. This value is then converted to a uint32_t, causing an approximately 4 GB read length that forces the server to read beyond the SSH channel data boundary. This overread writes process memory into the uploaded file, leaking libc, libcrypto, and PIE pointers. These leaked pointers allow bypassing ASLR, facilitating exploitation of other memory corruption vulnerabilities in the same process. The vulnerability affects ProFTPD versions prior to 1.3.9c and 1.3.10rc3.

Authenticated low-privilege attackers can bypass ASLR protections by exploiting this vulnerability, which leaks memory pointers from the server process. This leakage can enable attackers to reliably exploit other memory corruption vulnerabilities within the same process. The vulnerability does not directly allow remote code execution or denial of service but significantly lowers the difficulty of further exploitation by defeating ASLR.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, restrict access to trusted users and monitor for suspicious activity related to mod_sftp usage. Avoid exposing the affected ProFTPD versions to untrusted networks.