CVE-2026-63090

ProFTPD mod_sftp in fxp.c suffers a heap-based buffer overflow when oversized SFTP packet fragments exceed the 16 KB reassembly buffer. In ProFTPD 1.3.9c and 1.3.10rc3, authenticated low-priv attackers can cause arbitrary code execution by manipulating reallocation and memory, including overwriti...