CVE-2026-67191 Xlight FTP Server < 3.9.5 Pre-Auth Heap Buffer Overflow via SSH Parser
Remote unauthenticated attackers can achieve code execution on Xlight FTP Server by sending a malformed SSH client identification string due to a heap buffer overflow.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-67191?
CVE-2026-67191 is a critical memory corruption vulnerability in Xlight FTP Server, published on 29 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Xlight FTP Server before 3.9.5 contains a pre-authentication heap buffer overflow vulnerability that allows remote unauthenticated attackers to write past the end of a heap buffer by sending a malformed SSH client identification string. A logic error in the recv loop's termination condition uses an incorrect OR operator where an AND operator is required, enabling exploitation on any SSH or SFTP connection before authentication occurs.
Weakness: CWE-122
Which versions are affected by CVE-2026-67191?
How do I fix CVE-2026-67191?
No fix has been published for CVE-2026-67191 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-67191 being exploited?
There is no known exploitation of CVE-2026-67191 in the wild and no public exploit code.
Sources
Also known as GHSA-2w83-j663-7qg5.