A critical pre-authentication heap buffer overflow in Xlight FTP Server allows unauthenticated remote attackers to trigger memory corruption and potential code execution.

The vulnerability exists in the SSH/SFTP connection handling logic, specifically within the receive loop's termination condition. An incorrect logical operator allows an attacker to send a malformed identification string that overflows the heap buffer before authentication is ever required.

This flaw carries a CVSS score of 9.8 because it allows unauthenticated, remote code execution on the server hosting the FTP service. Compromise of this server could lead to complete data loss, unauthorized access to sensitive files, and full system takeover, posing an extreme risk to organizational data security.

Immediate Action: Upgrade Xlight FTP Server to version 3.9.5 or later immediately to resolve the memory corruption vulnerability.

Proactive Monitoring: Review server logs for frequent crashes or anomalous connection attempts targeting the SSH/SFTP ports of the FTP server.

Compensating Controls: If an immediate patch is not possible, restrict access to the FTP/SFTP service via firewall rules to known, trusted IP addresses only.

Public Exploit Available: No (exploit_available: false)

The risk posed by this pre-authentication vulnerability is severe and requires immediate attention. Organizations should prioritize updating all instances of Xlight FTP Server to version 3.9.5 to eliminate the potential for remote code execution.