CVE-2019-25614 Free Float FTP 1.0 STOR Command Remote Buffer Overflow

What is CVE-2019-25614?

CVE-2019-25614 is a critical memory corruption vulnerability in Freefloat Free Float FTP, published on 22 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Free Float FTP 1.0 contains a buffer overflow vulnerability in the STOR command handler that allows remote attackers to execute arbitrary code by sending a crafted STOR request with an oversized payload. Attackers can authenticate with anonymous credentials and send a malicious STOR command containing 247 bytes of padding followed by a return address and shellcode to trigger code execution on the FTP server.

Weakness: CWE-787

Which versions are affected by CVE-2019-25614?

It affects 1 product.

Products include Freefloat Freefloat Ftp Server.

How do I fix CVE-2019-25614?

No fix has been published for CVE-2019-25614 yet. Limit exposure of the affected software until one is available.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2019-25614 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2019-25614 exists.

Other vulnerabilities in Freefloat Free Float FTP

• CVE-2012-5106 Memory corruption in n/a Critical 10.0
• CVE-2012-10030 FreeFloat FTP Server Arbitrary File Upload Critical 9.3
• CVE-2012-10023 FreeFloat FTP Server USER Command Buffer Overflow Medium 6.9
• CVE-2025-5664 FreeFloat FTP Server RESTART Command buffer overflow Medium 6.9
• CVE-2025-5665 FreeFloat FTP Server XCWD Command buffer overflow Medium 6.9

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-cxxx-v554-jvph.