CVE-2019-25614: Free Float FTP 1.0 STOR Command Remote Buffer Overflow

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.0% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2026-03-22 · updated 2026-06-17
Weakness: CWE-787

Description

Free Float FTP 1.0 contains a buffer overflow vulnerability in the STOR command handler that allows remote attackers to execute arbitrary code by sending a crafted STOR request with an oversized payload. Attackers can authenticate with anonymous credentials and send a malicious STOR command containing 247 bytes of padding followed by a return address and shellcode to trigger code execution on the FTP server.

Affected products

FreeFloat FTP Server: 1.0

References

http://www.freefloat.com/software/freefloatftpserver.zip
https://www.exploit-db.com/exploits/46763
https://www.vulncheck.com/advisories/free-float-ftp-stor-command-remote-buffer-overflow

Get alerted when CVE-2019-25614 or the next vulnerability affects your stack