CVE-2026-67191: Xlight FTP Server < 3.9.5 Pre-Auth Heap Buffer Overflow via SSH Parser
Xlight · Xlight FTP Server
Fixed in 3.9.5 · Affected: Xlight FTP Server before 3.9.5 · Exploitation: not established
ExploitationNot established
Not in CISA KEV as of catalogue 2026.11.13 (13 Nov)
- In CISA KEV: not seen
- Exploited (reported): not seen
- Scanning observed: not seen
- Proof of concept public: not seen
- Not establishedNothing in the sources we check
Higher than 62% of scored CVEs
DescriptionNVD
Xlight FTP Server before 3.9.5 contains a pre-authentication heap buffer overflow vulnerability that allows remote unauthenticated attackers to write past the end of a heap buffer by sending a malformed SSH client identification string. A logic error in the recv loop's termination condition uses an incorrect OR operator where an AND operator is required, enabling exploitation on any SSH or SFTP connection before authentication occurs.
On the Atlas
Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.
- Exploitation
- Unlikely (under 1%). EPSS under 1%, or no score yet.
- CISA KEV
- Not listed
- Public check
- No public nuclei template
- Published
- July 2026
Coverage1 article · 1 outlet
First in our coverage: SecurityOnline, 4 Aug.
- Xlight FTP Server bug CVE-2026-67192 allows remote code executionSecurityOnline · first in our coverage
New articles also arrive in the RSS feed.