bftpd up to 6.2 Configuration File options.c expand_groups heap-based overflow

Summaryinfo

A vulnerability classified as problematic has been found in bftpd up to 6.2. The affected element is the function expand_groups of the file options.c of the component Configuration File Handler. The manipulation leads to heap-based overflow. This vulnerability is uniquely identified as CVE-2025-11947. Local access is required to approach this attack. Moreover, an exploit is present. The vendor was contacted early about this disclosure but did not respond in any way.

Detailsinfo

A vulnerability was found in bftpd up to 6.2 and classified as problematic. This issue affects the function expand_groups of the file options.c of the component Configuration File Handler. The manipulation with an unknown input leads to a heap-based overflow vulnerability. Using CWE to declare the problem leads to CWE-122. A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc(). Impacted is confidentiality, integrity, and availability.

It is possible to read the advisory at shimo.im. The identification of this vulnerability is CVE-2025-11947. The exploitation is known to be difficult. Attacking locally is a requirement. Technical details as well as a public exploit are known.

The exploit is available at shimo.im. It is declared as proof-of-concept. The vendor was contacted early about this disclosure but did not respond in any way.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the databases at CNNVD (CNNVD-202510-2555) and EUVD (EUVD-2025-35011). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• File Transfer Software

Name

• bftpd

Version

• 6.0
• 6.1
• 6.2

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Submitinfo

Accepted

• Submit #673133: bftpd Project bftpd FTP Server 6.2 Heap-based Buffer Overflow (by zh_vul)

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion