LightFTP CVE-2026-70637

Anonymous FTP access must be enabled on the LightFTP instance - this is the primary enabling condition, as the LIST/ABOR sequence can be issued without any credentials when anonymous login is permitted. The CVSS PR:N metric confirms no authentication is required. Exploitation further requires network-level reachability to TCP port 21 (or the configured FTP control port). The race condition is timing-dependent: the attacker must issue ABOR with sufficient proximity to the LIST-initiated data transfer to interleave with worker_thread_cleanup execution; this is reflected in AC:H and means unreliable, probabilistic triggering rather than guaranteed single-attempt success. What limits exploitation: (1) race window timing reduces single-attempt reliability (AC:H); (2) impact is confined to availability - no credential theft or code execution path identified; (3) anonymous access being disabled would entirely prevent unauthenticated exploitation. There is no requirement for a specific platform, OS, or non-default compile option beyond running LightFTP through 2.4 with anonymous FTP enabled.

The CVSS 4.0 vector AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N scores 8.2 and signals a network-reachable, unauthenticated attack with high availability impact but no confidentiality or integrity consequences. The AC:H rating honestly reflects the timing dependency inherent in triggering a race condition - exploitation requires repeated attempts and favorable scheduling, not a trivial single-packet trigger. A publicly available PoC (GitHub issue #75, tagged 'exploit' by cveorg) lowers the bar for opportunistic attackers who can automate the timing. However, LightFTP has a niche deployment footprint, limiting aggregate exposure. No EPSS score was provided in the input data, so exploitation probability cannot be quantitatively compared. The absence of CISA KEV listing suggests active mass exploitation has not been observed. Overall: moderate operational priority - high for any organization knowingly running LightFTP with anonymous access enabled on a network-exposed port, low for most enterprises that do not deploy this software.

An attacker connects anonymously to a LightFTP instance exposed on TCP port 21, issues a LIST command to open a data connection and trigger the worker thread, then rapidly sends ABOR in a tight loop to race the control thread's descriptor close against the worker thread's concurrent use. When timing aligns, the OS closes and reassigns the stale file descriptor to an unrelated resource mid-operation, causing undefined behavior that crashes the server. A publicly available PoC on GitHub (issue #75) demonstrates this sequence, making automated, repeated exploitation straightforward despite the AC:H complexity rating.