CVE-2016-20046: zFTP Client 20061220+dfsg3-4.1 Local Buffer Overflow

Severity: high (CVSS 8.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-03-28 · updated 2026-06-17
Weakness: CWE-787

Description

zFTP Client 20061220+dfsg3-4.1 contains a buffer overflow vulnerability in the NAME parameter handling of FTP connections that allows local attackers to crash the application or execute arbitrary code. Attackers can supply an oversized NAME value exceeding the 80-byte buffer allocated in strcpy_chk to overwrite the instruction pointer and execute shellcode with user privileges.

Affected products

zFTP Client: 20061220+dfsg3-4.1

References

http://cernlib.web.cern.ch/cernlib/
https://www.exploit-db.com/exploits/40203
https://www.vulncheck.com/advisories/zftp-client-20061220-dfsg3-local-buffer-overflow

Get alerted when CVE-2016-20046 or the next vulnerability affects your stack