CVE-2026-67191
CRITICAL
NVD
CVSS Score
9.8
Severity
CRITICAL
Published
Jul 29, 2026
Vendor
unknown
Description
Xlight FTP Server before 3.9.5 contains a pre-authentication heap buffer overflow vulnerability that allows remote unauthenticated attackers to write past the end of a heap buffer by sending a malformed SSH client identification string. A logic error in the recv loop's termination condition uses an incorrect OR operator where an AND operator is required, enabling exploitation on any SSH or SFTP connection before authentication occurs.