EUVD-2026-45961
GHSA-gqm5-f386-9r92
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable SCP parser with low complexity but requiring a valid low-privilege account (PR:L); impact is memory disclosure only, so C:H with I:N and A:N.
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
ProFTPD before 1.3.9c and 1.3.10rc3 contains a signed integer overflow vulnerability in the mod_sftp module's SCP size-record parser that allows authenticated low-privilege attackers to bypass ASLR by sending a crafted file size value of UINT64_MAX, which results in a negative off_t value. Attackers can exploit the subsequent conversion to uint32_t, causing an approximately 4 GB requested read length and forcing the server to read beyond the end of the SSH channel data and write overread process memory into the uploaded file. In tested configurations, the disclosed data contains libc, libcrypto, and PIE pointers sufficient to derive their randomized base addresses, thereby bypassing ASLR and enabling reliable exploitation of memory corruption vulnerabilities in the same process.
AnalysisAI
Memory disclosure and ASLR bypass in ProFTPD's mod_sftp SCP handler affects all releases before 1.3.9c and 1.3.10rc3, letting an authenticated low-privilege user leak server process memory into an uploaded file. By sending a crafted SCP size record of UINT64_MAX, an attacker triggers a signed integer overflow (CWE-190) that produces a ~4 GB overread, exposing libc, libcrypto, and PIE pointers. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the disclosed pointers are sufficient to defeat ASLR and make co-resident memory-corruption bugs reliably exploitable.
Technical ContextAI
ProFTPD is a widely deployed open-source FTP daemon; the flaw lives in its mod_sftp module, which implements the SSH/SCP subsystem. During SCP transfers the server parses a size-record field describing the length of an incoming file. That value is read into a signed off_t; supplying UINT64_MAX (0xFFFFFFFFFFFFFFFF) makes off_t negative, and the subsequent narrowing conversion to a 32-bit uint32_t yields a requested read length of roughly 4 GB. This is a textbook CWE-190 integer-overflow-to-wraparound: because the length is attacker-controlled and no bounds check catches the negative-to-unsigned transition, the server reads past the end of the buffered SSH channel data and copies adjacent process memory into the file being written to disk (an overread turned into information disclosure). The single affected component per the CPE (cpe:2.3:a:proftpd:proftpd) is the ProFTPD application itself.
RemediationAI
Vendor-released patch: upgrade to ProFTPD 1.3.9c (stable) or 1.3.10rc3-3 if tracking the 1.3.10 release-candidate line; the fix is commit b9b7dde1bcd74bc23366484d53856b67b8d6d95e (see https://github.com/proftpd/proftpd/pull/2201 and the RELEASE_NOTES). Where immediate patching is not possible, the most effective compensating control is to disable SCP handling in mod_sftp so only interactive SFTP is offered, which closes the vulnerable size-record parser at the cost of breaking legacy scp-based automation. Alternatively, restrict SFTP/SCP access to trusted authenticated users only and audit existing accounts, since exploitation requires valid low-privilege credentials; if mod_sftp is not needed at all, unload the module entirely to remove the attack surface. Consult the VulnCheck advisory (https://www.vulncheck.com/advisories/proftpd-mod-sftp-signed-integer-overflow-via-scp-size-record-parser) before choosing a workaround.
The mod_copy module in ProFTPD 1.3.5 allows remote attackers to read and write to arbitrary files via the site cpfr and
The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remot
An arbitrary file copy vulnerability in mod_copy in ProFTPD up to 1.3.5b allows for remote code execution and informatio
SQL injection escalating to remote code execution in ProFTPD's mod_sql before 1.3.10rc1 lets remote attackers inject SQL
SQL injection in ProFTPD 1.3.9a and earlier allows remote attackers to execute arbitrary SQL commands when the 'UseRever
make_ftp_cmd in main.c in ProFTPD before 1.3.8a has a one-byte out-of-bounds read, and daemon crash, because of mishandl
ProFTPD before 1.3.6b and 1.3.7rc before 1.3.7rc2 allows remote unauthenticated denial-of-service due to incorrect handl
Integer overflow in kbdint.c in mod_sftp in ProFTPD 1.3.4d and 1.3.5r3 allows remote attackers to cause a denial of serv
In ProFTPD 1.3.7, it is possible to corrupt the memory pool by interrupting the data transfer channel. Rated high severi
Arbitrary code execution in ProFTPD's mod_sftp module (versions before 1.3.9c and 1.3.10rc3) allows authenticated low-pr
Directory ACL bypass in ProFTPD (through 1.3.9b and 1.3.10rc2) lets authenticated FTP users reach files inside DenyAll-p
Authenticated remote denial of service in ProFTPD's mod_sftp module allows any user with valid SFTP credentials to crash
Same weakness CWE-190 – Integer Overflow or Wraparound
View allSame technique Buffer Overflow
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Linux Enterprise High Performance Computing 15 SP7 | Affected |
| SUSE Linux Enterprise Module for Server Applications 15 SP7 | Affected |
| SUSE Linux Enterprise Server 15 SP7 | Affected |
| SUSE Linux Enterprise Server for SAP Applications 15 SP7 | Affected |
| SUSE Linux Enterprise Module for Server Applications 15 SP6 | Affected |
| SUSE Linux Enterprise Server 15 SP6 | Affected |
| SUSE Linux Enterprise Server 15 SP6-LTSS | Affected |
| SUSE Linux Enterprise Server for SAP Applications 15 SP6 | Affected |
| SUSE Linux Enterprise High Performance Computing 15 SP6 | Affected |
| openSUSE Leap 15.6 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today