CVE-2026-67191: Xlight FTP Server Buffer Overflow Flaw

CVE-2026-67191 Overview

CVE-2026-67191 is a pre-authentication heap buffer overflow in Xlight FTP Server versions prior to 3.9.5. The vulnerability resides in the SSH client identification string parser and can be triggered by any remote, unauthenticated attacker who can reach the server's SSH or SFTP listener. A logic error in the recv loop termination condition uses an OR operator where an AND operator is required, allowing bytes to be written past the end of a heap buffer. Because the flaw is reached before authentication, successful exploitation can result in memory corruption, denial of service, or arbitrary code execution in the context of the FTP service.

Critical Impact
Unauthenticated remote attackers can corrupt heap memory on any exposed Xlight SSH or SFTP endpoint by sending a malformed client identification string, enabling potential remote code execution.

Affected Products

Xlight FTP Server versions prior to 3.9.5
SSH service component of Xlight FTPD
SFTP service component of Xlight FTPD

Discovery Timeline

2026-07-29 - CVE-2026-67191 published to the National Vulnerability Database (NVD)
2026-07-29 - Last updated in NVD database

Technical Details for CVE-2026-67191

Vulnerability Analysis

The vulnerability is a heap-based buffer overflow classified under CWE-122. It affects the SSH client identification string parser inside Xlight FTPD. When an SSH or SFTP client connects, the server reads the initial identification banner into a heap-allocated buffer using a recv loop. The loop is intended to stop reading when either the buffer is full or a line terminator is received. Because the termination condition uses a logical OR instead of a logical AND, the loop continues to accept bytes after the buffer boundary should have been enforced.

An attacker can supply an oversized identification string that exceeds the allocated heap buffer. The excess bytes overwrite adjacent heap metadata and objects, corrupting the allocator state and giving the attacker influence over subsequent memory operations. The full description of the flaw is documented in the VulnCheck advisory for the Xlight FTP SSH parser overflow.

Root Cause

The root cause is an inverted boolean condition in the loop that reads the SSH client identification string. The correct guard should require that the buffer still has capacity AND that no terminator has been received. Using OR allows the loop to continue when only one of the two conditions is true, meaning the read proceeds past the end of the destination buffer.

Attack Vector

Exploitation requires only network reachability to the SSH or SFTP port exposed by Xlight FTP Server. No credentials, no user interaction, and no prior session state are required. The malformed identification string is delivered during the initial protocol handshake, before authentication is performed. Any client that can complete a TCP connection to the service can trigger the vulnerable code path.

No public proof-of-concept exploit is currently listed for this CVE. Technical details of the root cause and reproduction path are described in the VulnCheck advisory.

Detection Methods for CVE-2026-67191

Indicators of Compromise

Unusually long SSH client identification banners (well beyond the ~255 byte SSH protocol norm) sent to Xlight FTPD listeners.
Xlight FTP Server process crashes, restarts, or heap corruption entries in Windows Application or service logs shortly after inbound SSH or SFTP connections.
SSH or SFTP connections from unexpected source addresses that terminate before authentication but after banner exchange.

Detection Strategies

Inspect network traffic to TCP ports handling SSH or SFTP on Xlight servers for oversized SSH-2.0 banners that lack a proper CR/LF terminator.
Alert on Xlight FTPD service crashes, unexpected worker process exits, or Windows Error Reporting entries referencing the Xlight binary.
Correlate pre-authentication SSH sessions with anomalous outbound connections or new child processes from the Xlight service account.

Monitoring Recommendations

Enable verbose SSH connection logging in Xlight FTPD and forward logs to a centralized SIEM for retention and analysis.
Monitor the Xlight service for repeated restarts, which may indicate exploitation attempts triggering heap corruption crashes.
Track the version of Xlight FTP Server across the environment and alert on any instance below 3.9.5 exposed to untrusted networks.

How to Mitigate CVE-2026-67191

Immediate Actions Required

Upgrade all Xlight FTP Server instances to version 3.9.5 or later, as noted on the Xlight FTPD release page.
Restrict inbound access to SSH and SFTP ports of Xlight servers to trusted source ranges using host or network firewalls.
Audit externally exposed Xlight FTPD instances and take them offline until they are patched.

Patch Information

The vendor has addressed the flaw in Xlight FTP Server 3.9.5. The corrected release fixes the SSH client identification parser so the recv loop terminates when the buffer boundary is reached, preventing the out-of-bounds write. Refer to the Xlight FTPD new features and fixes page for the release listing and download.

Workarounds

If patching cannot be performed immediately, disable the SSH and SFTP protocols in Xlight FTPD configuration and rely only on FTP or FTPS listeners until the upgrade is applied.
Place Xlight FTP Server behind a VPN or bastion so that only authenticated network peers can reach the SSH and SFTP ports.
Apply source IP allow-listing at the perimeter for any Xlight instance that must remain reachable before it can be upgraded.

bash

# Example: restrict inbound SSH/SFTP (TCP 22) to a trusted management subnet on Windows
netsh advfirewall firewall add rule name="Xlight SFTP - Allow trusted" \
  dir=in action=allow protocol=TCP localport=22 remoteip=10.10.0.0/24

netsh advfirewall firewall add rule name="Xlight SFTP - Block others" \
  dir=in action=block protocol=TCP localport=22