CVE-2026-63091 in ProFTPD
Summary
by MITRE • 07/20/2026
ProFTPD before 1.3.9c and 1.3.10rc3 contains a signed integer overflow vulnerability in the mod_sftp module's SCP size-record parser that allows authenticated low-privilege attackers to bypass ASLR by sending a crafted file size value of UINT64_MAX, which results in a negative off_t value. Attackers can exploit the subsequent conversion to uint32_t, causing an approximately 4 GB requested read length and forcing the server to read beyond the end of the SSH channel data and write overread process memory into the uploaded file. In tested configurations, the disclosed data contains libc, libcrypto, and PIE pointers sufficient to derive their randomized base addresses, thereby bypassing ASLR and enabling reliable exploitation of memory corruption vulnerabilities in the same process.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/20/2026
The vulnerability under discussion represents a critical signed integer overflow flaw within the ProFTPD server's mod_sftp module specifically affecting versions prior to 1.3.9c and 1.3.10rc3. This issue resides in the SCP size-record parser component which processes file size information during secure copy operations. The vulnerability stems from improper handling of large integer values where a crafted file size parameter set to UINT64_MAX triggers an overflow condition that fundamentally alters memory management behaviors within the server process. According to CWE-190, this represents a classic signed integer overflow condition that occurs when a program processes a signed integer and the result exceeds the maximum value that can be represented by the data type.
The technical exploitation mechanism operates through a series of cascading type conversions that ultimately compromise memory safety. When an authenticated attacker sends a file size parameter with the value UINT64_MAX, this value undergoes processing within the SCP parser where it gets converted to an off_t type which is typically signed. This conversion results in a negative off_t value due to the overflow condition. Subsequently, the system converts this negative value to uint32_t type, creating an approximately 4 gigabyte read length request that far exceeds normal file transfer boundaries. The ATT&CK framework categorizes this as a memory corruption technique under T1070.004 (File and Directory Permissions Modification) and T1555.003 (Credentials from Password Stores) since the exploitation can lead to privilege escalation through memory corruption.
The operational impact of this vulnerability extends beyond simple denial-of-service conditions to enable sophisticated exploitation techniques that specifically target modern security mitigations. When the server attempts to process this malformed request, it reads beyond the boundaries of SSH channel data and overwrites process memory into the uploaded file, effectively leaking memory contents that include libc, libcrypto, and PIE pointers. This memory leakage directly undermines ASLR (Address Space Layout Randomization) protections which are fundamental security mechanisms designed to randomize memory layout addresses making exploitation of memory corruption vulnerabilities significantly more difficult. The vulnerability essentially provides attackers with a reliable method to discover randomized base addresses through information disclosure, fundamentally weakening the security posture of the affected system.
The exploitation process leverages the predictable nature of the memory leakage to bypass ASLR protections that would otherwise prevent successful exploitation of memory corruption vulnerabilities in the same process. This capability enables attackers to reliably target subsequent exploits that may be designed to gain code execution or escalate privileges, making this vulnerability particularly dangerous in environments where ProFTPD serves as a primary file transfer service. The combination of authenticated access requirements with the ability to bypass critical security mitigations creates a significant threat vector for both privilege escalation and information disclosure attacks, particularly in enterprise environments where such services are commonly deployed and maintained.