CVE-2026-63090

Name	CVE-2026-63090
Description	ProFTPD before 1.3.9c and 1.3.10rc3 contains a heap-based buffer overflow vulnerability in the mod_sftp module that allows authenticated low-privilege attackers to achieve arbitrary code execution by sending crafted SFTP packet fragments exceeding the 16 KB reassembly buffer in the fxp.c component. Attackers can supply oversized fragments to trigger an incorrectly conditioned reallocation, corrupt pool freelist metadata, overwrite the root_fs BSS global pointer to reference a fake filesystem struct, and redirect pr_fsio_stat() to system() via a crafted RENAME request.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
proftpd-dfsg (PTS)	bullseye	1.3.7a+dfsg-12+deb11u2	vulnerable
	bullseye (security)	1.3.7a+dfsg-12+deb11u5	vulnerable
	bookworm	1.3.8+dfsg-4+deb12u5	vulnerable
	bookworm (security)	1.3.8+dfsg-4+deb12u4	vulnerable
	trixie	1.3.8.c+dfsg-4+deb13u2	vulnerable
	forky, sid	1.3.9c~dfsg-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
proftpd-dfsg	source	(unstable)	1.3.9c~dfsg-1

https://github.com/proftpd/proftpd/issues/2190
Fixed by: https://github.com/proftpd/proftpd/commit/ce13286900a7e25f1e3403620496868d73292f6b (v1.3.9c)