CVE-2026-67192: Xlight FTP Server Buffer Overflow Flaw

CVE-2026-67192 Overview

CVE-2026-67192 is a pre-authentication stack buffer overflow [CWE-121] in Xlight FTP Server versions before 3.9.5. The flaw lives in the SSH subsystem, where an unvalidated length field from a malformed SSH packet is passed directly to the Galois/Counter Mode (GCM) decrypt routine when a GCM cipher is negotiated. Unauthenticated remote attackers can corrupt the stack, overwrite the stack cookie and saved return address, and potentially achieve remote code execution before any authentication check runs.

Critical Impact
Unauthenticated network attackers can trigger a stack buffer overflow during SSH key exchange to overwrite the return address and execute arbitrary code on the FTP server host.

Affected Products

Xlight FTP Server versions prior to 3.9.5
Xlight FTP Server deployments with SSH/SFTP enabled and GCM ciphers permitted
Any Windows host exposing the vulnerable Xlight SFTP service to untrusted networks

Discovery Timeline

2026-07-29 - CVE-2026-67192 published to the National Vulnerability Database (NVD)
2026-07-29 - Last updated in NVD database

Technical Details for CVE-2026-67192

Vulnerability Analysis

The vulnerability resides in Xlight FTP Server's SSH transport layer. During SSH session negotiation, the client can select a GCM-mode cipher such as aes128-gcm@openssh.com or aes256-gcm@openssh.com. Once the GCM cipher is active, the server reads a length field from incoming SSH packets and forwards that value to the GCM decrypt function without bounds validation. A crafted length larger than the destination stack buffer causes a linear stack write past the buffer boundary.

Because the overflow occurs before authentication completes, any host reachable on the SFTP listening port is exposed. The overwrite reaches the compiler-inserted stack cookie and the saved return address, giving attackers the primitives needed to hijack control flow and execute arbitrary code in the context of the Xlight service process.

Root Cause

The root cause is missing input validation on an attacker-controlled length field passed to a cryptographic primitive. The SSH packet parser trusts the length prefix and copies data into a fixed-size stack buffer during GCM decryption. This is a textbook stack-based buffer overflow classified under [CWE-121].

Attack Vector

Exploitation requires only network reachability to the SFTP port. The attacker completes the initial SSH banner exchange, negotiates a GCM cipher during the key exchange, and then sends a malformed encrypted packet with an oversized length value. No credentials, user interaction, or prior foothold are required. The vulnerability is described in the VulnCheck advisory for Xlight FTP Server.

Detection Methods for CVE-2026-67192

Indicators of Compromise

Unexpected termination or restart of the xlight.exe process, particularly following SFTP connections from unknown sources
SFTP sessions that negotiate aes128-gcm@openssh.com or aes256-gcm@openssh.com and disconnect abnormally during key exchange
New child processes, outbound network connections, or file writes originating from the Xlight service account after a failed SSH handshake
Windows Error Reporting entries or crash dumps referencing the Xlight binary with access violation exceptions on the stack

Detection Strategies

Alert on Xlight service crashes correlated with inbound SSH traffic within a short time window
Baseline expected SFTP client sources and flag anomalous connections from unfamiliar IP ranges targeting the SFTP port
Inspect SSH packet lengths at the network layer where TLS/SSH inspection is available and flag oversized length prefixes

Monitoring Recommendations

Forward Xlight application logs and Windows Application event logs to a centralized SIEM for correlation with network telemetry
Monitor for post-exploitation behavior such as command shell spawning, credential access, or lateral movement from the Xlight host
Track process integrity and code injection events on servers running Xlight to identify successful exploitation attempts

How to Mitigate CVE-2026-67192

Immediate Actions Required

Upgrade Xlight FTP Server to version 3.9.5 or later on all affected hosts
Restrict inbound access to the SFTP listener using firewall rules that permit only known client networks
Audit Xlight configuration files to identify enabled ciphers and disable GCM ciphers until patching is complete
Review recent SFTP session logs for anomalous connections and Xlight process crashes

Patch Information

The vendor has released Xlight FTP Server 3.9.5, which addresses the missing length validation in the SSH GCM decrypt path. Refer to the Xlight FTPD Release Notes for the official change log and download links. Administrators should apply the update on every server running Xlight, including internal-only deployments, because pre-authentication reachability is sufficient for exploitation.

Workarounds

Remove aes128-gcm@openssh.com and aes256-gcm@openssh.com from the list of permitted SSH ciphers in the Xlight configuration
Place the SFTP service behind a VPN or bastion so it is not exposed to untrusted networks
Temporarily disable the SSH/SFTP protocol in Xlight if only FTP or FTPS is required for business operations

bash

# Example: block external access to the Xlight SFTP port on Windows
netsh advfirewall firewall add rule name="Block Xlight SFTP External" ^
  dir=in action=block protocol=TCP localport=22 ^
  remoteip=any profile=any