CVE-2025-4079 PCMan FTP Server RENAME Command buffer overflow

Medium 6.9 Published 29 Apr 2025 Updated 29 Apr 2025

Remote attackers can trigger a buffer overflow in PCMan FTP Server via the RENAME command, potentially leading to code execution or service disruption.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2025-4079?

CVE-2025-4079 is a medium-severity memory corruption vulnerability in Pcman Ftp Server, published on 29 Apr 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A vulnerability, which was classified as critical, was found in PCMan FTP Server up to 2.0.7. Affected is an unknown function of the component RENAME Command Handler. The manipulation leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

Weakness: CWE-120, CWE-119

Which versions are affected by CVE-2025-4079?

It affects 1 product.

Products include Pcman Ftp Server.

How do I fix CVE-2025-4079?

No fix has been published for CVE-2025-4079 yet. Limit exposure of the affected software until one is available.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2025-4079 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-4079 exists.

All Pcman Ftp Server vulnerabilities

Sources

Also known as GHSA-9xq3-wmwq-jv6r.