CVE-2026-63090 ProFTPD mod_sftp Heap Buffer Overflow via SFTP Packet Reassembly
Authenticated attackers can achieve arbitrary code execution and privilege escalation via a heap buffer overflow in ProFTPD's SFTP module.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-63090?
CVE-2026-63090 is a high-severity memory corruption vulnerability in proftpd, published on 20 Jul 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
ProFTPD before 1.3.9c and 1.3.10rc3 contains a heap-based buffer overflow vulnerability in the mod_sftp module that allows authenticated low-privilege attackers to achieve arbitrary code execution by sending crafted SFTP packet fragments exceeding the 16 KB reassembly buffer in the fxp.c component. Attackers can supply oversized fragments to trigger an incorrectly conditioned reallocation, corrupt pool freelist metadata, overwrite the root_fs BSS global pointer to reference a fake filesystem struct, and redirect pr_fsio_stat() to system() via a crafted RENAME request.
Weakness: CWE-122
Which versions are affected by CVE-2026-63090?
It affects 1 product.
Products include Proftpd Proftpd.
How do I fix CVE-2026-63090?
Upgrade to a fixed version.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-63090 being exploited?
There is no known exploitation of CVE-2026-63090 in the wild and no public exploit code.
Other vulnerabilities in proftpd
Sources
Also known as DEBIAN-CVE-2026-63090, GHSA-wxc2-grp8-f55h, UBUNTU-CVE-2026-63090.