CVE-2019-25681

HIGH

Xlight FTP Server 3.9.1 SEH Overwrite Buffer Overflow

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2019-25681 has a selected CVSS score of 8.6 (high); EIP currently links 1 catalogued exploit.

Description

Xlight FTP Server 3.9.1 contains a structured exception handler (SEH) overwrite vulnerability that allows local attackers to crash the application and overwrite SEH pointers by supplying a crafted buffer string. Attackers can inject a 428-byte payload through the program execution field in virtual server configuration to trigger a buffer overflow that corrupts the SEH chain and enables potential code execution.

Description source: CVE List

Exploitation context

Available material

Catalogued exploits
1

CISA SSVC decision

ExploitationPoC
AutomatableNo
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Apr 6, 2026 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

Xlight

Browse Xlightftpd / Xlight
CVE List3.9.1affected

Proofs of concept

1

Catalogued exploits

ExploitDBXlight FTP Server 3.9.1 - Buffer Overflow (PoC)ExploitDB exploitby Logan WhitmireNot analyzed1 file
ExploitDB
PoC details

References

5