CVE-2026-63091: ProFTPD Privilege Escalation Vulnerability

CVE-2026-63091 Overview

CVE-2026-63091 is a signed integer overflow vulnerability in the ProFTPD mod_sftp module's SCP size-record parser. The flaw affects ProFTPD versions before 1.3.9c and 1.3.10rc3. Authenticated low-privilege attackers can send a crafted file size of UINT64_MAX, which produces a negative off_t value. The subsequent conversion to uint32_t triggers an approximately 4 GB read length, causing the server to write overread process memory into the uploaded file. Disclosed memory contains libc, libcrypto, and Position Independent Executable (PIE) pointers usable to derive randomized base addresses. The weakness is classified as [CWE-126] Buffer Over-read.

Critical Impact
Attackers with valid SFTP credentials can bypass Address Space Layout Randomization (ASLR) by exfiltrating process memory, enabling reliable exploitation of memory corruption bugs in the same process.

Affected Products

ProFTPD versions prior to 1.3.9c
ProFTPD versions prior to 1.3.10rc3
Deployments using the mod_sftp module with SCP upload support

Discovery Timeline

2026-07-20 - CVE-2026-63091 published to the National Vulnerability Database (NVD)
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-63091

Vulnerability Analysis

The vulnerability resides in the recv_filesz() function within contrib/mod_sftp/scp.c. The original implementation parses the client-provided size string digit by digit into an off_t value without validating overflow. When a client sends UINT64_MAX as the file size, the accumulated value wraps into a negative off_t. Downstream logic converts this negative value to uint32_t, producing a request for roughly 4 GB of data. The server then reads past the end of the SSH channel buffer and copies adjacent process memory into the uploaded file. This constitutes an out-of-bounds read that leaks sensitive runtime data to an authenticated attacker.

Root Cause

The root cause is missing input validation and unsafe numeric conversion between signed and unsigned integer types. The parser did not enforce a maximum size, did not check for overflow during accumulation, and did not reject negative results. The signed-to-unsigned cast amplified the negative value into a very large positive length used to control a read operation.

Attack Vector

An attacker with a valid low-privilege SFTP account initiates an SCP upload over the network. During the SCP protocol handshake, the client transmits the file size record. Supplying UINT64_MAX triggers the overflow. The resulting file contains contents of adjacent process memory, including libc, libcrypto, and PIE pointers sufficient to compute randomized base addresses and defeat ASLR.

// Security patch in contrib/mod_sftp/scp.c
static int recv_filesz(pool *p, uint32_t channel_id, const char *size_str,
    off_t *filesz) {
  char *endp = NULL;
  unsigned long long sz;
  *filesz = 0;

#if defined(HAVE_STROULL)
  sz = strtoull(size_str, &endp, 10);
#else
  sz = strtoul(size_str, &endp, 10);
#endif /* HAVE_STROULL */

  *filesz = (off_t) sz;

  /* Watch for cases where the sent file size might overflow our size type. */
  if (*filesz < 0) {
    pr_trace_msg(trace_channel, 2, "file size out of range");
    write_confirm(p, channel_id, 1, "file size out of range");
    return -1;
  }

  if (endp == NULL ||
      *endp != ' ') {

Source: ProFTPD Commit b9b7dde. The patch replaces manual digit accumulation with strtoull(), casts the result to off_t, and explicitly rejects negative sizes before further processing.

Detection Methods for CVE-2026-63091

Indicators of Compromise

Uploaded files whose recorded size is at or near UINT64_MAX (18446744073709551615) in mod_sftp transfer logs.
Unexpectedly large files (approximately 4 GB) received via SCP that do not match legitimate user workflows.
ProFTPD trace messages containing file size out of range after applying the patch, indicating attempted exploitation.

Detection Strategies

Parse ProFTPD mod_sftp and SCP transaction logs for anomalous file size declarations and correlate against user identity and source IP.
Alert on outbound file writes from ProFTPD process memory space that exceed configured upload limits or expected user quotas.
Monitor authenticated SFTP sessions initiating SCP uploads from unusual source addresses or during off-hours windows.

Monitoring Recommendations

Enable ProFTPD SFTPLog and TransferLog directives with sufficient verbosity to capture SCP size records.
Forward ProFTPD logs to a centralized analytics platform for retention and correlation with authentication events.
Track version banners across the ProFTPD fleet to confirm all instances are running 1.3.9c, 1.3.10rc3-3, or later.

How to Mitigate CVE-2026-63091

Immediate Actions Required

Upgrade ProFTPD to version 1.3.9c or 1.3.10rc3-3, which contain the fixed recv_filesz() implementation.
Audit SFTP account inventory and disable or rotate credentials for accounts that do not require SCP upload capability.
Review recent SCP upload logs for size records near UINT64_MAX to identify potential exploitation attempts.

Patch Information

The fix is committed in ProFTPD commit b9b7dde and merged via Pull Request 2201. Fixed releases are published at ProFTPD v1.3.9c and ProFTPD v1.3.10rc3-3. Additional context is available in the VulnCheck ProFTPD Advisory and the ProFTPD Release Notes.

Workarounds

Disable the mod_sftp module or restrict SCP upload functionality if patching cannot be performed immediately.
Limit SFTP access to trusted networks using firewall rules or Allow/Deny directives until upgrades complete.
Enforce strict per-user upload size limits via MaxStoreFileSize to reduce the practical impact of oversized transfers.

bash

# Configuration example: restrict SCP uploads and enforce size limits
<IfModule mod_sftp.c>
  SFTPEngine on
  SFTPLog /var/log/proftpd/sftp.log
  # Cap per-file storage size to a reasonable value (e.g., 1 GB)
  MaxStoreFileSize 1073741824 bytes
  # Restrict SFTP/SCP access to trusted networks
  <Limit LOGIN>
    Allow from 10.0.0.0/8
    DenyAll
  </Limit>
</IfModule>