EUVD-2026-50399
GHSA-pvvv-gmf8-6fw8
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network pre-auth (AV:N/PR:N/UI:N); AC:H because exploitation depends on GCM cipher negotiation and defeating the overwritten stack cookie for RCE; full C/I/A impact on the service.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
Xlight FTP Server before 3.9.5 contains a pre-authentication stack buffer overflow vulnerability that allows unauthenticated attackers to corrupt stack memory by sending malformed SSH packets when a GCM cipher is negotiated. Attackers can craft packets with an unvalidated length field passed directly to the GCM decrypt function, overwriting the stack cookie and return address to potentially achieve remote code execution before any authentication occurs.
AnalysisAI
Remote code execution in Xlight FTP Server versions before 3.9.5 allows unauthenticated attackers to corrupt stack memory by sending malformed SSH packets once an AES-GCM cipher is negotiated during the SSH/SFTP handshake. An unvalidated length field is passed directly to the GCM decrypt routine, overwriting the stack cookie and saved return address before any authentication occurs, potentially yielding code execution as the FTP service. Reported by VulnCheck; no public exploit has been identified at time of analysis, but the pre-auth, network-reachable nature makes it a high priority.
Technical ContextAI
The affected component is the SSH transport layer of Xlight FTP Server (cpe:2.3:a:xlight:xlight_ftp_server), a Windows FTP/SFTP server implementing SFTP-over-SSH. The root cause is CWE-121 (stack-based buffer overflow): an attacker-controlled length field from an incoming SSH packet is passed without validation into the AES-GCM decryption function, causing more bytes to be written to a fixed-size stack buffer than it can hold. Because the overflow occurs in the packet-processing path that runs before credential verification, it is reachable pre-authentication. The overflow reaches the stack canary and the saved return address - the classic precondition for control-flow hijacking - though the presence of the stack cookie means reliable RCE requires a cookie leak or bypass.
RemediationAI
Upgrade to Xlight FTP Server 3.9.5 or later (Vendor-released patch: 3.9.5), the definitive fix; see the vendor changelog at https://www.xlightftpd.com/whatsnew.htm and the VulnCheck advisory at https://www.vulncheck.com/advisories/xlight-ftp-server-pre-auth-stack-buffer-overflow-via-ssh-gcm-cipher. If immediate patching is not possible, restrict network exposure of the SSH/SFTP listener (typically TCP 22) via firewall rules or a VPN so only trusted hosts can reach it, since the flaw is pre-authentication. As a targeted workaround, disable AES-GCM ciphers in the SSH cipher configuration (leaving CBC/CTR ciphers), which removes the specific vulnerable code path, at the cost of reduced cipher choice and possible interoperability issues with GCM-only clients; if SFTP is not required, disable the SSH/SFTP module entirely.
Xlight FTP Server 3.9.1 contains a structured exception handler (SEH) overwrite vulnerability that allows local attacker
Pre-authentication heap buffer overflow in Xlight FTP Server before 3.9.5 lets remote unauthenticated attackers write pa
Xlight FTP Server before 3.9.5 on Windows leaks the system's GetTickCount() value to unauthenticated remote attackers vi
Same weakness CWE-121 – Stack-based Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today